It was early morning just after dawn and the ATIS at Rochester, Minnesota, was advertising a runway visual range (RVR) of 1,200 feet. In the old days it would have also reported “sky obscured, ceiling indefinite.” Now it said “vertical visibility 200 feet.”
For some reason of geography or elevation, or whatever, Rochester seems to get more than its share of fog. I’m sure that’s the reason the airport authorities invested in the full approach lighting system and centerline and touchdown zone lights buried in the main runway. With those, the ILS approach minimum is 1,800 RVR feet instead of the standard Category I ILS 2,400 feet RVR minimums.
We asked approach control if the RVR was varying, and they said no. Austin airport is just over 20 miles southwest of Rochester so I asked to divert there. Austin was clear and I could see the runway not long after turning toward it. Approach cleared us for the visual, and a few seconds later issued a vector to a Challenger crew for the ILS approach into Rochester.
What? Oh, they said, the RVR had just bounced up to 1,800 feet. I told them give me a vector for the ILS, I really want to be in Rochester, not Austin.
This was going to be an ILS to real life minimums. There would be no “breaking out,” just a very quick look at the glow of the approach lights and then over the touchdown zone lights. It was a job for the autopilot, for sure.
The Collins autopilot in the King Air 350i did its usual perfect job of flying the ILS. When the radio altimeter system called “100 feet” I bumped the trim switch under my thumb to disengage the autopilot. It handed me the airplane in perfect trim and exactly on centerline over the lights. An easy landing.
So was that all legal? Yes. The autopilot in the King Air 350i is certified to be engaged down to 79 feet agl on approach. Do you know the operating altitude limitations for the autopilot in your airplane?
All autopilots have limitations, including minimum operating altitudes. They also usually have a limitation that you must be sitting at the controls with your seat belt fastened while the autopilot is engaged. I always chuckle at that one, but then I’ve heard stories from more than one pilot who has left the cockpit, trusting the autopilot to remain engaged and flying normally.
In general aviation airplanes the autopilot limitations are not normally in the “limitations” section of the pilot operating handbook (POH). The reason is that the autopilot system is not typically type certified in the airplane but is a supplemental approval. Because of that the autopilot limitations and other operating information is in the supplements section near the back of the book.
Autopilot altitude engagement limitations are for minimum altitude after takeoff, minimum altitude for cruise operation, and minimum altitude on approach. The restrictions are based on certification testing of what happens after a possible failure.
An autopilot quitting and doing nothing is called a “passive failure” because the system simply stops doing anything. That’s bad for a pilot who’s not paying much attention because—especially in the clouds or at night—the airplane could wander off into a dangerous attitude before the pilot notices the autopilot has quit.
That’s a primary reason minimum altitude for operation in cruise is higher than on approach, or for engagement after takeoff. The certification theory is that any rational pilot is paying close attention to the instruments and flight path on approach or on climb out after takeoff, but in cruise flight none of us are riveted on the flight instruments 100 percent of the time. It’s also why all autopilots now have a loud, annoying warning sound, and usually flashing lights, to alert to disengagement, intended or otherwise.
A passive autopilot failure is not the worst possible. The most threatening is called a “hard over” where the system unexpectedly and without warning drives the flight controls to their limits with maximum autopilot authority.
Probably the most worrisome autopilot failure is a pitch trim runaway. Autopilots, just like we humans, use both the elevator and pitch trim to control the airplane. If the automatic pitch trim system runs away while the autopilot is engaged, the elevator servo will use all of its available muscle to resist the trim forces. But when the pitch servo runs out of authority, the autopilot will disengage, or continue to try to fly the airplane while the nose pitches up or down in response to the trim forces.
Either way, the pilot who experiences a pitch trim runway will be handed a badly out of trim airplane with totally unexpected control forces. Many pilots have mistaken those forces for autopilot actions even though the autopilot disengaged, or the pilot pressed the button to disengage the autopilot. Pilots who believe they are in a struggle with the automatic system rather than an out of trim airplane forget to simply retrim just as they would when hand flying. It’s easy to imagine how confusing and surprising such a situation can be, and how it can end badly, and many have.
During autopilot certification test flights, all of these failures are induced and must be handled safely by the test pilot. The key element here is “recognition time,” the time it would supposedly take for a normal pilot to identify the autopilot failure and react properly. The test pilot obviously knows a failure is coming, but must wait the specified recognition time before taking any action to simulate the “surprise” factor of a normal pilot having an unexpected failure.
Historically the recognition time for autopilot failure or trim runaway has been three seconds in normal flight. During approach the recognition time is cut to 1.5 or perhaps 2 seconds in the belief the human pilot is very alert and can identify the problem quickly.
Those recognition times have come under attack recently after the two crashes of the Boeing 737 Max blamed on failure of a stability augmentation system. As with an autopilot, the system was certified based on a time for the pilots to recognize a failure and react correctly. Recognition times have been in the certification standards since the earliest days of automated flight control systems. Maybe they are too short to accommodate the “average” pilot and give him time to identify and take corrective action after a failure. But as long as the human pilot is being “certified” as part of the system, a reaction time is the only way to include the pilot as monitor and ultimate pilot authority.
Take a look at the limitations for your autopilot. Most likely the minimum altitude will be 200 feet on approach. Many autopilot systems also have a flap limitation so using the autopilot with full flaps down to 200 feet may not be authorized.
I would suspect your autopilot minimum engagement altitude will be higher than the 400 feet that is standard in the turbine airplane world. And almost certainly it won’t be approved for cruise flight below 1,000 feet agl.
But when the weather is low and the approach is going to be close to minimums, let the autopilot fly. Even the FAA is so convinced of the superiority of autopilots that it lowered the minimums to 1,800 feet RVR on longer Cat I ILS runways that lack runway centerline lights as long as you let the autopilot fly down to decision height.
Hand flying down to bare minimums is something to do in training under the hood, or the simulator. In the real world of IFR flying the autopilot and flight director are the way to stay on the centerline all the way down to DH, and for some autopilots, even below that.