Autopilot — Page 363, Lesson 430

Let’s pick this up right where the torque-limiting safeguards leave off, because that’s the bridge into how the autopilot is actually allowed to take control. So, we just covered that the autopilot’s servomotors are protected by limiting their torque, and by letting them slip or fully disengage if those torque limits are exceeded. That protection can be mechanical, electrical, or electromechanical. Now, before the autopilot is ever allowed to fly the aircraft, there’s a gatekeeping system. That’s what I want to walk you through now: the engagement criteria. The first concept is the Autopilot Inner Loop. Think of this as the internal feedback path that keeps the autopilot’s own servos and sensors stable and working correctly. Before we couple the autopilot to the aircraft’s control system, we have to prove that this inner loop is healthy. If it isn’t, the autopilot could command something unsafe. So the integrity of that inner loop must be established first. To monitor that inner loop, the aircraft uses a system of interlocks. An interlock is essentially a permission gate. These interlocks close — meaning they complete a circuit — to allow autopilot engagement, and they hold it engaged, but only if the correct valid signals have been received. If a signal is missing or wrong, the interlock stays open and the autopilot cannot engage. The classic way to picture this is a number of relays wired in series. I want you to imagine several switches in a single line, like a chain. Every relay in that chain has to be closed for current to flow. If any one of them opens, the whole circuit breaks. That’s exactly how the interlocks work — they’re all in series, so one failure kills the whole engagement path. In modern aircraft, that physical relay switching is more likely done by solid-state logic switching, but the principle is identical: a series of conditions that must all be satisfied. Now, here’s the critical safety behavior. If a circuit monitored by a relay fails, the autopilot will disengage, and that disengagement is accompanied by aural and visual warning indications — so you get a sound and a light. And importantly, operating the disengage switch — the pilot pressing the disconnect — has exactly the same effect. So a failure and a deliberate pilot disconnect both break that series chain and drop the autopilot out. Now let’s move to the Conditions of Engagement. These are the specific requirements that must be met before the autopilot will actually engage. They vary by aircraft type, and the example we’re using is the Boeing 737-400. On the 737-400, each autopilot is engaged by pressing a separate CMD or CWS engage switch. Let me define those two modes. CMD is Command mode — the autopilot actively flies the aircraft, moving the control surfaces. CWS is Control Wheel Steering — in that mode, the autopilot holds the attitude you command by moving the control wheel, and it follows your inputs rather than flying a programmed path. Both are engagement options, but they’re different in how much authority the autopilot takes. Now, engagement in either CMD or CWS is inhibited — blocked — unless two pilot-controlled conditions are both met. The first: no force is being applied to the control wheel. If you’re holding or pushing on the yoke, the autopilot won’t engage. The second: the Stabilizer Trim Autopilot Cut-out Switch must be at NORMAL. That’s a physical switch that, when not in NORMAL, cuts out the autopilot’s ability to command the stabilizer trim. So it has to be in the NORMAL position for engagement to be allowed. Once both of those conditions are satisfied, and no failures exist, either autopilot can be engaged in CMD or CWS by pressing the respective engage switch. So you press the CMD switch for that autopilot, or the CWS switch, and it engages. Here’s a subtle but important behavior after engagement. If you apply control pressure — that is, you push on the control wheel — after the autopilot is already engaged in CMD, the autopilot overrides into CWS pitch and/or roll. So a firm input on the yoke bumps the autopilot out of full Command mode and into Control Wheel Steering, in the pitch axis, the roll axis, or both, depending on where you applied the pressure. And through all of this, the light remains illuminated in the CMD engage switch — so the annunciation stays lit to tell you the autopilot is still engaged, even though it has shifted into CWS. So the whole picture is: interlocks in series prove the inner loop is healthy, two pilot conditions must be met, and once engaged, a control input can demote the autopilot from CMD to CWS while keeping the engage light on. That’s the engagement logic for the 737-400.