From SKYbrary Wiki
An autopilot is a device used to guide an aircraft without direct assistance from the pilot. Early autopilots were only able to maintain a constant heading and altitude, but modern autopilots are capable of controlling every part of the flight envelope from just after take-off to landing. Modern autopilots are normally integrated with the flight management system (FMS) and, when fitted, the autothrottle system.
Autopilot software, which is integrated with the navigation systems, is capable of providing control of the aircraft throughout each phase of flight. If an autothrottle/autothrust system is installed, the appropriate thrust may be automatically set during take-off, and is then adjusted automatically as the climb progresses, while the aircraft climbs at the appropriate speed for its mass and ambient conditions. The aircraft then levels at the required altitude or flight level while the power is adjusted to achieve and maintain the programmed speed. At the same time, the aircraft follows the flight plan route. If an autothrottle is not installed, the pilot must make all power adjustments appropriate to the autopilot mode and phase of flight.
On commencing the descent, the power is adjusted and the aircraft descends at the appropriate speed and on the required routing, leveling as required in accordance with the flight clearance until the approach is commenced. If this is to be a Category III Instrument Landing System (ILS) approach with Autoland, the autopilot controls the aircraft flight path so that it follows the ILS glide path and localiser, adjusting the power to maintain the appropriate speed and commencing the flare as required to achieve a safe landing without the runway being visible until the final stage of the approach. On some aircraft, the autopilot can then guide the aircraft so that it maintains the runway centre-line until it stops.
At any stage of the flight, the pilot can intervene by making appropriate inputs to the autopilot or the FMS. In an emergency, the pilot can disengage the autopilot and take over manual control, usually by pressing a switch mounted conveniently on the control column (although alternative means of disengaging the autopilot are available). Modern aircraft have another switch or throttle position which allows the pilot to change instantly from approach to go-around mode if necessary. If the aircraft is not fitted with an automatic go-around function, pilots must disconnect the autopilot and fly the missed approach manually.
The safe and efficient operation of automatic systems relies on clear understanding of the capabilities and the design philosophy of the equipment. Failure to achieve this level of understanding has resulted in several fatal accidents.
- OIG Audit Report: Enhanced FAA Oversight Could Reduce Hazards Associated With Increased Use of Flight Deck Automation, 2016
Accidents and Incidents
The following events involved airworthiness issues associated with the autoflight system:
- A319, south of London UK, 2005 (On 22 October 2005, a British Airways Airbus A319 climbing en route to destination over south east England at night in VMC experienced a major but temporary electrical failure. Most services were re-instated within a short time and the flight was continued. However, during the subsequent Investigation, which took over two years, a series of significant deficiencies were identified in the design of the A320 series electrical system and the manufacturer-recommended responses to failures in it and in response, Airbus developed solutions to most of them.)
- UAV, manoeuvring, north of Reims France, 2006 (On 29 February 2016, control of a 50 kg, 3.8 metre wingspan UAV was lost during a flight test being conducted in a Temporary Segregated Area in northern Belgium. The UAV then climbed to 4,000 feet and took up a south south-westerly track across Belgium and into northern France where it crash-landed after the engine stopped. The Investigation found that control communications had been interrupted because of an incorrectly manufactured co-axial cable assembly and a separate autopilot software design flaw not previously identified. This then prevented the default recovery process from working. A loss of prescribed traffic separation was recorded.)
- B38M, en-route south east of Addis Ababa Ethiopia, 2019 (On 10 March 2019, left air data system faults on a Boeing 737-MAX 8 soon after departing Addis Ababa were followed by autopilot disconnection, left stick shaker activation and two successive periods of automatic nose down stabiliser causing EGPWS ‘DON’T SINK’ alerts. Recovery was achieved using manual stabiliser trim but prior to a third automatic pitch down, the trim system was switched off as per the runaway stabiliser drill but briefly reinstated to help recover from it. Recovery from a fourth automatic pitch down was not achieved and a high speed dive led to terrain impact six minutes after takeoff.)
- B743, vicinity Tehran Mehrabad Iran, 2015 (On 15 October 2015 a Boeing 747-300 experienced significant vibration from one of the engines almost immediately after take-off from Tehran Mehrabad. After the climb out was continued without reducing the affected engine thrust an uncontained failure followed 3 minutes later. The ejected debris caused the almost simultaneous failure of the No 4 engine, loss of multiple hydraulic systems and all the fuel from one wing tank. The Investigation attributed the vibration to the Operator's continued use of the engine without relevant Airworthiness Directive action and the subsequent failure to continued operation of the engine after its onset.)
- B735, vicinity Perm Russian Federation, 2008 (On September 13 2008, at night and in good visual conditions*, a Boeing 737-500 operated by Aeroflot-Nord executed an unstabilised approach to Runway 21 at Bolshoye Savino Airport (Perm) which subsequently resulted in loss of control and terrain impact.)
Events in the SKYbrary database which include AP/FD and/or ATHR status awareness as a contributory factor:
- A320, vicinity Lyons Saint-Exupéry France, 2012 (On 11 April 2012, a Hermes Airlines A320 commanded by a Training Captain who was also in charge of Air Operations for the airline was supervising a trainee Captain on a night passenger flight. The aircraft failed to establish on the Lyons ILS and, in IMC, descended sufficiently to activate both MSAW and EGPWS 'PULL UP' warnings which eventually prompted recovery. The Investigation concluded that application of both normal and emergency procedures had been inadequate and had led to highly degraded situational awareness for both pilots. The context for this was assessed as poor operational management at the airline.)
- A332 MRTT, en-route, south eastern Black Sea, 2014 (On 9 February 2014, the Captain of a military variant of the Airbus A330 suddenly lost control during the cruise on a passenger flight. A violent, initially negative 'g', pitch down occurred which reached 15800 fpm as the speed rose to Mach 0.9. In the absence of any effective crew intervention, recovery was achieved entirely by the aircraft Flight Envelope Protection System. The Investigation found that the upset had occurred when the Captain moved his seat forward causing its left arm rest to contact the personal camera he had placed behind the sidestick, forcing the latter fully forward.)
- A343, en-route, mid North Atlantic Ocean, 2011 (On 22 July 2011 an Air France A340-300 en route over the North Atlantic at FL350 in night IMC encountered moderate turbulence following "inappropriate use of the weather radar" which led to an overspeed annunciation followed by the aircraft abruptly pitching up and gaining over 3000 feet in less than a minute before control was regained and it was returned to the cleared level. There Investigation concluded that "the incident was due to inadequate monitoring of the flight parameters, which led to the failure to notice AP disengagement and the level bust, following a reflex action on the controls.”)
- AT76, en route, west-southwest of Sydney Australia, 2014 (On 20 February 2014, an ATR 72-600 crew mishandled their response to an intended airspeed adjustment whilst using VS mode during descent to Sydney and an upset involving opposite control inputs from the pilots caused an elevator disconnect. The senior cabin attendant sustained serious injury. After recovery of control, the flight was completed without further event. Post flight inspection did not discover damage to the aircraft which exceeded limit and ultimate loads on the stabilisers and the aircraft remained in service for a further five days until it was grounded for replacement of both horizontal and vertical stabilisers.)
- B732, vicinity Resolute Bay Canada, 2011 (On 20 August 2011, a First Air Boeing 737-200 making an ILS approach to Resolute Bay struck a hill east of the designated landing runway in IMC and was destroyed. An off-track approach was attributed to the aircraft commander’s failure to recognise the effects of his inadvertent interference with the AP ILS capture mode and the subsequent loss of shared situational awareness on the flight deck. The approach was also continued when unstabilised and the Investigation concluded that the poor CRM and SOP compliance demonstrated on the accident flight were representative of a wider problem at the operator.)