The answer is, whenever the autopilot maneuvers the airplane in some way you didn’t expect, or don’t fully understand, disengage the autopilot and hand fly.
If you ask yourself “what’s it doing now” the immediate answer should be to punch it off.
Autopilots can and do occasionally fail. When they do, the certification theory is that the human pilot is always in position and fully capable of taking over control of the airplane. That’s why the flight manual supplement limitations for autopilot use all decree that a qualified pilot must be seated at the controls.
But a more frequent failure of automatic flight is the human pilot’s lack of understanding of the autopilot modes and operation. A real hardware/software failure of an autopilot could lead to a dangerous situation, but so can pilot mismanagement of a fully functioning autopilot. The results are essentially the same in either situation—the pilot in command is not fully in control of the airplane.
Avidyne and Garmin, and some other autopilot makers, are very aware of gaps in pilots’ complete understanding of autopilot operation. That’s a reason they pioneered the “straight and level” mode. If you are not completely aware of what the autopilot is doing, or what the attitude and rate of change of the airplane is, pressing the straight and level mode button levels the wings and holds a safe pitch attitude.
For much of the history of general aviation autopilots were probably much more reliable than the sensors they require. For example, in the bad old days when we relied on vacuum pumps to stay alive while flying in the clouds, a pump failure would disable the autopilot as well as deprive us of essential gyro attitude and heading information. Even when the pump worked, the spinning metal gyro reliability was not good. And even if the gyro continued to spin, the electrical elements that transmitted the gyro data to the autopilot could and did fail.
Reliability—plus low cost—was a selling point for S-TEC rate-based autopilots. Those systems use a turn coordinator gyro to derive a sort of wings level information for the autopilot. Because the system doesn’t really know if the wings are level, only that the airplane is turning or not, they don’t fly with the same precision as a conventional autopilot. But the S-TEC would keep working after the vacuum pump or attitude gyro failed, and that was an important safety advantage.
The better solution that is happily becoming more available and common in all types of airplanes is the attitude heading reference system (AHRS) that uses non-moving electronic sensors to calculate attitude and heading and yaw. With no moving parts the AHRS is much more reliable than the vacuum pump/spinning metal rotor gyro. And because AHRS use so little electrical power it’s easy to install a battery that keeps the AHRS working for 30 minutes, or much more, after a total electrical failure.
With AHRS providing the essential aircraft attitude data, and vastly improved components in the autopilot itself, the reliability of automatic flight control is much better than even a decade ago. But I’m not sure all pilots are receiving the training necessary to safely and fully use the automatic flight control systems. At least that’s true at the piston airplane level.
Think about it. Will you find even a basic autopilot in a training airplane? Almost never, except at universities and major flight academies where the curriculum is designed to create professional pilots. Everybody in aviation knows that when a pilot moves beyond the basic singles used for training they will use an autopilot, but when will they be trained? Sadly, many never are, at least in a comprehensive way.
I believe one of the best ways to learn how your autopilot works is to perform the complete preflight test that is described—often even required—in the flight manual supplement in your POH.
The autopilot test will confirm that the different methods to disengage the autopilot actually work. Most autopilots have several ways to disengage the system. There is a button under your thumb on the control wheel horn that, when pushed, disengages the autopilot. In most systems pushing the button all the way down also removes power from the electric pitch trim. If the autopilot has full pitch functions, moving the electric pitch trim button on the yoke with the autopilot engaged will disengage it. And there is a button or lever on the autopilot mode control to disengage. All of those methods to disengage the autopilot are checked during the preflight test.
Any newer full function autopilot will have a “split” electric trim switch. That means that two switches must close to send power to the electric pitch trim servo. In most systems the trim switch under your thumb has two halves, and both halves of the switch must be moved together to activate the pitch trim. In others you push down and then move the switch fore or aft for trim. Either way, you’re checking the circuity, and safety, by moving only half the switch at a time to make sure the trim doesn’t activate.
Most newer autopilots also have some level of monitoring. The monitor circuit is primarily concerned with un-commanded pitch trim movement, which is potentially the most hazardous automatic flight control system failure. During the preflight check you will press a button or touch a key to test the continuity of the monitor circuit.
Finally—and I believe the most important aspect of the autopilot check—is that you test the servo clutches. Autopilot servos—the devices that actually move the flight controls—have a system that limits their authority. In other words, the muscle of the autopilot has low limits.
To test the actual strength, as it were, of the autopilot, you engage it on the ground, and then move the flight controls to be sure you can easily overpower the system. You’ll be surprised how little effort is required to overpower the autopilot servo. That teaches you that if the autopilot goes crazy and for whatever extremely rare circumstance won’t disengage, you can take command manually.
The even more critical preflight test is to engage the autopilot in a pitch mode and pull and then push on the controls. When you pull back with the autopilot engaged, after a brief delay, the pitch trim should start to run nose-down. Push on the controls and the pitch trim should run nose-up.
Because the autopilot servos are comparatively weak, they must keep the airplane in trim in order to hold the desired pitch attitude and/or altitude. When the autopilot senses an out-of-trim force it commands the pitch trim servo to move until the force is relieved. That is exactly the same logic we use when hand flying.
What is so vital—and has undoubtedly been the cause of many accidents—is to learn from the preflight test that if you push or pull on the wheel while the autopilot is engaged, you will cause the system to mis-trim the airplane. If you continue to push or pull long enough with the autopilot engaged, the trim force could become so great it overpowers you. It’s easy to overpower the autopilot, but may be impossible to overpower the trim.
I remember years ago being at the old King Radio hangar in Olathe, Kansas, the day after a lucky, but untrained, pair of A36 Bonanza pilots arrived hopping mad because the King autopilot had tried to kill them. The autopilot was doing something the pilot didn’t like, or understand, so he grabbed the controls to take over. Before long, according to him, the autopilot gained superhuman strength. If he hadn’t had a pilot friend in the right seat joining him to pull on the control wheel the damn autopilot would have flown them both to their death.
What happened, of course, is the pilot didn’t disengage the autopilot before pulling on the wheel. For several seconds he easily overpowered the autopilot pitch servo, but his pulling caused the pitch trim servo to run nose down. Before long the trim tabs were full nose down and the stick force was incredible. He and his buddy wrestled the Bonanza to the runway without ever thinking of reaching over to the trim wheel to retrim the airplane, all the while convinced the autopilot was trying to kill them.
And that’s the last step in the preflight test. Run the electric trim and grab the trim wheel to be sure you can physically stop its motion. If you can’t keep the trim wheel from moving with your thumb on the electric pitch trim, don’t fly the airplane until it’s repaired.
Finally, when you’re reading the POH autopilot supplement check the altitude limitations for autopilot engagement. On a precision approach the minimum engaged altitude is most likely 200 feet, the standard DH for an ILS or LPV approach. But there may be restrictions on how much flap can be extended during the coupled approach. On departure there will be a limitation on minimum AGL altitude for autopilot engagement, usually 400 feet in larger airplanes, but often 1,000 feet in lighter airplanes. There are also typically minimum altitudes for autopilot use in cruise. These minimums are the result of worst case failure flight testing and demonstrated that a trained and competent pilot had sufficient altitude to recover after the failure.
Autopilots offer huge potential safety. That’s why you can’t fly single-pilot for hire, or in a jet, without them. But all of that safety potential can turn into a hazard if the human pilot isn’t fully trained on autopilot use.