Autopilot — Page 358, Lesson 419

I want to walk you into the autopilot chapter by starting with the single most important safety idea in the whole system — the fail-safe autopilot. Because before we ever talk about what an autopilot can do, we have to talk about what happens when it goes wrong. With any automatic system, you have to protect against malfunctions — and the malfunction that worries us most is called a runaway. A runaway is exactly what it sounds like: the autopilot drives a control surface to its limit and keeps driving it, with no intention of stopping. If that happens, the aircraft will keep pitching or rolling until you're in serious trouble. So the design goal is to make sure the pilot can always win. There are two ways we achieve that protection. The first is by limiting the authority of the actuator — that means restricting how far the actuator is allowed to move the control surface in the first place. The second is by limiting the rate at which the actuator can travel — that means restricting how fast it's allowed to move. Either way, the effect is the same: the autopilot simply cannot command a movement big enough or fast enough that you, the pilot, can't overpower it with your own muscle on the controls. The point of all this is that in the event of an autopilot failure, you should always be able to override the effects of the malfunction and retain control of the aircraft. A system built this way is called a fail-safe system, and that term applies to any single autopilot. So when you hear "fail-safe," think: the system is designed so that its own failure can never take control away from the pilot. Now, with that safety foundation laid, let's look at the basic autopilot itself. And I want to be honest with you — the basic autopilot is a very simple system. But understanding it is absolutely essential, because if you understand the basic autopilot, you can understand and explain what any autopilot is doing at any point throughout the flight. Every autopilot you'll ever fly is built on this foundation. The key function of an autopilot is aircraft stabilization. And here's something important: for some basic autopilots, stabilization is all they achieve. All the fancy modes you've heard of — VOR tracking, altitude hold, and so on — those are extras. They're built on top of stabilization, but stabilization is the core job. Let me take you back to an early aircraft design to see why. Originally, all that was required was a system that would keep the aircraft flying in the same attitude once the pilot was happy with it. The pilot could then concentrate on navigation, disengaging the autopilot as necessary to correct headings and so on. So the autopilot wasn't there to navigate — it was there to hold the attitude steady while the pilot did the thinking. To design such a system, we need to think about the sequence of events that must occur to keep the aircraft's attitude constant. And the best way to see this is to consider yourself flying a light aircraft — say, a Warrior — in slightly turbulent conditions. Now imagine the aircraft experiences a disturbance in pitch. What happens? Let me walk you through how a human pilot handles that, because the autopilot is going to mimic exactly this. First, the human pilot senses a change in aircraft attitude. Second, he computes the necessary corrective action required. Third, he uses his muscles to move the flight controls. The aircraft then manoeuvres about its centre of gravity back towards its original position. And then — this is the crucial closing of the loop — he will sense that the correction has worked, and the cycle continues. So there's the sequence: sense the change, compute the correction, move the controls, the aircraft manoeuvres about its centre of gravity back to the original attitude, and then sense again. That's the loop. And the basic autopilot is simply a machine that performs that same sequence — sensing attitude, computing the correction, and moving the controls — but faster and without getting tired. That's where we're headed. We've got the safety principle — fail-safe, limiting authority or rate to beat a runaway. We've got the core function — stabilization. And we've got the human loop that the autopilot will replicate. Next, we'll see how the autopilot actually senses, computes, and moves — the components that make that loop real.