Uncommanded Autopilot Disconnect: Guidance For Flight Crews
Uncommanded Autopilot Disconnect: Guidance For Flight Crews
This article seeks to provide generalized guidance for pilots. Nothing herein should be taken as a substitute for aircraft-specific guidance found in the Quick Reference Handbook (QRH) or other relevant manuals.
Definition
Any failure or disconnect of an engaged autopilot not intended by the flight crew.
Description
A number of things can cause an autopilot to disconnect. Depending on aircraft model, they can include:
- Accidental press of autopilot button on the aircraft's guidance panel
- Accidental press of autopilot disconnect button on the control wheel or stick
- Unintended actuation of manual pitch trim
- Activation of wind shear escape guidance
- Malfunction in a fly-by-wire system
- Failure of the Altitude and Heading Reference System (AHRS), Air Data Computer (ADC) or other avionics or guidance unit
- Activation of stick shaker (due to low speed or system malfunction)
- Flight control disconnect due to jammed flight control surface
- Pilot input on the control column or stick that is contrary to autopilot input
- Internal system failure
Autopilot disconnect is normally accompanied by an aural alert. If the disconnect is due to a system failure, the disconnect will normally be accompanied by an Engine Indicating and Crew Alerting System (EICAS) message.
Defences
An uncommanded autopilot disengagement should not, by itself, create an emergency. Pilots should be prepared to hand fly in all phases of flight. In fact, the Minimum Equipment List (MEL) for many commercial aircraft allow the aircraft to be dispatched with a deferred autopilot. QRH procedures for this malfunction often call for waiting a few seconds, then attempting to reset the autopilot.
The situation can quickly turn into an emergency if the the flight crew fails to notice the autopilot disconnect. This can happen due to distraction, task saturation, or other reasons. An uncommanded autopilot disconnect played a role in the Dec. 29, 1972 crash of Eastern Airlines Flight 401 while on approach to Miami, Florida, in the United States. The accident involving a Lockheed L-1011 became a case study in flight crew resource management and other issues. Due to the disengaged autopilot, the aircraft began an uncommanded descent that went unnoticed by the crew.
A primary defence involves close adherence to Pilot Flying and Pilot Monitoring roles. The pilot flying should focus solely on aircraft control and the status of any automation in use.
Another important defence is systems knowledge. Pilots should be aware of what causes autopilot disengagement in their aircraft, and expect it in certain situations. For example, if the Standard Operating Procedures (SOP) manual says activation of wind shear escape guidance will cause an autopilot disconnect, pilots should mentally prepare to hand fly when wind shear conditions are present. Similarly, if a control surface jams due to fouled control cables, the QRH might call for pulling a disconnect handle to separate the captain's and first officer's controls, then flying the aircraft from the unjammed side. In most aircraft, pilots should expect the autopilot to become inoperative with this condition.
Additionally, when an uncommanded autopilot disconnect occurs, pilots should remain alert for related malfunctions that might be more serious. One example is a possible runaway of elevator, rudder, or aileron trim. The cutout switches in trim motors help ensure that a runaway trim will not exceed certain limitations and render the aircraft uncontrollable. However, by the time cutout switches stop the runaway trim, aircraft control could be marginal. Therefore, pilots should consult the QRH and consider the status of the aircraft's flight controls and trim tabs before reactivating the autopilot and/or trim systems.
If required by SOP, a proper preflight check of autopilot and fly-by-wire systems can identify a malfunction. However, the systems in many modern aircraft run continuous built-in tests, and a manual preflight check is not part of pilot procedures. In these aircraft, a test fail normally generates an EICAS message.
Other Considerations
If the autopilot fails, the aircraft cannot fly in Reduced Vertical Separation Minima (RVSM) airspace. That means air traffic control must be notified, and the aircraft must receive clearance to descend below FL290. Additionally, the aircraft cannot fly Category II and III Instrument Landing System approaches. However, this restriction does not prevent a captain from using emergency authority to fly such an approach if no other option is available.
If an autopilot disconnects during an instrument approach, the approach by may be continued by hand flying unless company procedures call for in a missed approach. However, if the autopilot malfunction causes the aircraft to deviate significantly from course guidance, a go-around should be initiated.
Accidents and Incidents
On 5 April 2019, a Boeing 737-500 crew declared an emergency shortly after departing Madrid Barajas after problems maintaining normal lateral, vertical or airspeed control of their aircraft in IMC. After two failed attempts at ILS approaches in unexceptional weather conditions, the flight was successfully landed at a nearby military airbase. The Investigation found that a malfunction which probably prevented use of the Captain’s autopilot found before departure was not documented until after the flight but could not find a technical explanation for inability to control the aircraft manually given that dispatch without either autopilot working is permitted.
On 4 March 2016, the flight crew of an ATR72-500 decided to depart from Manchester without prior ground de/anti icing treatment judging it unnecessary despite the presence of frozen deposits on the airframe and from rotation onwards found that manual forward control column input beyond trim capability was necessary to maintain controlled flight. The aircraft was subsequently diverted. The Investigation found that the problem had been attributable to ice contamination on the upper surface of the horizontal tailplane. It was considered that the awareness of both pilots of the risk of airframe icing had been inadequate.
On 27 February 2012, the crew of an Airbus A330 en route at night and crossing the East African coast at FL360 encountered sudden violent turbulence as they flew into a convective cell not seen on their weather radar and briefly lost control as their aircraft climbed 2000 feet with resultant minor injuries to two occupants. The Investigation concluded that the isolated and rapidly developing cell had not been detected because of crew failure to make proper use of their weather radar, but noted that activation of flight envelope protection and subsequent crew action to recover control had been appropriate.
On 20 July 2011, the flight crew of a Swiss European Avro RJ-100 on a positioning flight from Nuremburg to Zurich responded inappropriately to an unexpected ‘bank angle’ alert in IMC. Near loss of control followed during which a PAN was eventually declared. The situation was resolved by a belated actioning of the QRH checklist applicable to the failure symptoms experienced. The subsequent investigation attributed the event to inappropriate crew response to a failure of a single IRU and poor manual flying skill whilst the situation was resolved.
On 24 May 2013 the fan cowl doors on both engines of an Airbus A319 detached as it took off from London Heathrow. Their un-latched status after a routine maintenance input had gone undetected. Extensive structural and system damage resulted and a fire which could not be extinguished until the aircraft was back on the ground began in one engine. Many previously-recorded cases of fan cowl door loss were noted but none involving such significant collateral damage. Safety Recommendations were made on aircraft type certification in general, A320-family aircraft modification, maintenance fatigue risk management and aircrew procedures and training.
Categories
