Autopilot — Page 358, Lesson 419

I want to walk you through the fail-safe autopilot and then the basic autopilot, because these two ideas are the foundation for everything else in the chapter. Let's start with the fail-safe concept. With any automatic system, you have to protect against malfunctions — and the specific malfunction that worries us most is called a runaway. A runaway is when the autopilot drives a control surface to its limit and keeps driving it, with no intention of stopping. If that happens, the aircraft would pitch or roll hard and you'd lose control. So how do we protect against that? Two ways. Either we limit the authority of the actuator — that is, how far it's allowed to move the control surface — or we limit the rate at which the actuator can travel, meaning how fast it's allowed to move. Either way, the pilot must always be able to override the effects of a malfunction and retain control of the aircraft in the event of autopilot failure. A system built this way is called a fail-safe system, and the term applies to any single autopilot. Now, the basic autopilot. This is a very simple system, but I want you to understand it thoroughly, because understanding the basic autopilot is essential for understanding and explaining what any autopilot is doing throughout the flight. Every autopilot you'll ever fly is built on this core. The key function of an autopilot is aircraft stabilization. In fact, for some basic autopilots, stabilization is all they achieve. All the fancy modes — VOR tracking, altitude hold, and so on — those are extras on top of stabilization. Don't lose sight of that. Let's think about an early aircraft design. All that was originally required was a system that would keep the aircraft flying in the same attitude once the pilot was happy with it. Then the pilot could concentrate on navigation, disengaging the autopilot as necessary to correct headings and so on. To design such a system, we need to consider the sequence of events that must occur to keep the aircraft's attitude constant. So imagine yourself flying a light aircraft — say, a Warrior — in slightly turbulent conditions. Now the aircraft experiences a disturbance in pitch. Here's how a human pilot handles that. The pilot senses a change in aircraft attitude, computes the necessary corrective action required, and uses his muscles to move the flight controls. The aircraft then manoeuvres about its centre of gravity back towards its original position. Then the pilot senses that the correction has worked and the attitude is restored. That's the human loop: sense, compute, act, verify. The basic autopilot is simply a machine that replicates that loop. It senses attitude, computes the correction, and moves the controls — and it does it faster and more consistently than a human can. So hold onto this: stabilization is the heart of the autopilot. Everything else is an extra. And the fail-safe principle — limiting authority or rate so the pilot can always override — is the safety net that makes the whole thing trustworthy.