Autopilot Instrument Inputs and Failures

Key Autopilot Instrument Inputs

Autopilot systems depend on several primary inputs:

• Attitude information from the Inertial Reference System (IRS) provides pitch, roll, and yaw data.
• Airspeed, altitude, and pressure data from the Air Data Computer (ADC) are essential for speed and altitude hold functions.
• Flight path and trajectory information, often from navigation systems or the Flight Management System (FMS), enables lateral and vertical guidance.
• Control surface position feedback ensures the autopilot knows the actual position of ailerons, elevators, and rudder.
• Aircraft configuration inputs (such as flap or gear position) are used for envelope protection and approach logic.
• Pilot selections via the Mode Control Panel (MCP) or Flight Control Unit (FCU) set targets and modes.

Typical Failures and Effects

Failures can be sensor-based (e.g., IRS or ADC malfunction), system-based (e.g., electrical power loss), or related to the autopilot itself. Key points:

• Incorrect sensor data (such as faulty attitude or airspeed) may cause the autopilot to command unsafe maneuvers, sometimes without immediate failure warnings.
• Loss of critical inputs (like ILS signals during approach) may trigger autopilot disengagement or warnings, particularly below alert height.
• Autopilot channel failures in multi-channel systems are managed by redundancy. In fail-operational (three-channel) systems, one failure allows continued operation; in fail-passive (two-channel), a single failure leads to autopilot disengagement.
• Series actuator saturation can result in loss of control authority, requiring pilot intervention.

Automatic Mode Reversion

If the autopilot loses suitable data for a selected mode (e.g., navigation discontinuity, altitude change during capture, or excessive vertical speed selection), it may automatically revert to a safer mode or disengage to prevent unsafe flight.

Pilot Action and System Protection

Modern autopilots include interlocks and synchronization features to prevent engagement when conditions are unsafe or data is invalid. However, pilots must remain vigilant, as some failures may not trigger immediate warnings, making prompt recognition and manual intervention critical.