Is an autopilot failure an emergency?

Question

If the autopilot of an airliner fails, but everything else still works, weather conditions are good, and the pilots are able to hand-fly the plane with no problems, is this an emergency? Would they divert to the nearest suitable airport, or continue to the destination?

Answer 1

It's not an emergency, but there is a significant workload increase because both pilots now have to be paying attention full time, with one watching the other flying, vs only one (watching the AP) when the AP is engaged, and the other doing paperwork, or napping (sometimes). But otherwise, not that big a deal.

Lots of airplanes only have a single autopilot system (following commands from one of two Flight Directors). You need a working autopilot to fly above 29000 ft in RVSM airspace (where crossing traffic is only 1000ft above or below), but you don't necessarily have to have it engaged, and ATC doesn't know whether you have it engaged or not. Lots of pilots will hand fly for part of the cruise phase just for something to do, paying very close attention to the altitude to avoid getting busted for a deviation.

In any case, if the autopilot actually fails, you are no longer RVSM compliant and are required to notify ATC of the failure, and you will likely be told to descend below RVSM airspace, to finish your trip (which can impose a significant fuel burn penalty on a turbofan or turbojet). At that point you just carry on, and may decide to alternate hand flying back and forth every 15 minutes, or whatever, to limit workload on each pilot.

Lots of small commuter airplanes, like Beech 1900s, are not equipped with autopilots at all (if the airline is cheap) and the crews just alternate hand flying all the time (they can't get get up to RVSM airspace if they wanted to, so that's not an issue).

Answer 2

I have hand-flown an airliner both sectors (there and back) on one occasion. It was 2 hours there and 2 hours back (dispatched with the autopilot inoperative) so in good weather it is not an issue. But as pointed out in another answer, it is very demanding. It is difficult to hand fly at 35,000 feet with cabin crew with meal carts and passengers walking back and forth - not an ideal situation. It would be prohibited in RVSM airspace however.

Not part of the question but included for a complete answer: check in the Minimum Equipment list and/or Dispatch Deviation guide for the airplane. Some airplanes are certified to fly single crew in IMC; a functional 3 axis autopilot might be a prerequisite. If it fails in flight in IMC it might be construed as an emergency. In the image below, the airliner does not require an autopilot for dispatch if weather and operational requirements permit, therefore it would not be an emergency if it failed in flight under those conditions.

Answer 3

As an aside: There is at least one instance where an autopilot failure or unintended disconnect is an emergency: when you fly a plane into icing conditions on autopilot, and the autopilot progressively trims the plane to maintain the programmed altitude profile as it ices up, right up to the point where it runs out of trim authority and then kicks off-line, handing the pilot an unflyable plane which then immediately spin/stalls into the ground.

Answer 4

As an avionics software engineer I would not consider this situation as an emergency. Please see following explanation may give you an insight.

Software Level which is frequently called as the Design Assurance Level (DAL) as defined in ARP4754 and DO-178C, is determined from the safety assessment process and hazard analysis by examining the effects of a failure condition in the system.

The failure conditions are categorized by their effects on the aircraft, crew, and passengers.

Basically the effects are categorized as;

Catastrophic - Failure may cause deaths, usually with loss of the airplane.

Hazardous - Failure has a large negative impact on safety or performance, or reduces the ability of the crew to operate the aircraft due to physical distress or a higher workload, or causes serious or fatal injuries among the passengers.

Major - Failure significantly reduces the safety margin or significantly increases crew workload. May result in passenger discomfort (or even minor injuries).

Minor - Failure slightly reduces the safety margin or slightly increases crew workload. Examples might include causing passenger inconvenience or a routine flight plan change.

No Effect - Failure has no impact on safety, aircraft operation, or crew workload.

Answer 5

Under certain typical conditions loss of Autopilot is not an emergency:

• The loss of autopilot is annunciated (like through a chime or flashing indicator)
• We're not discussing helicopters where Stability Augmentation is more than a little convenient.
• The flight plan doesn't require autopilot. This would not be the case for RVSM altitudes, a CAT II or CAT III approach, or an approach procedure with RNP < 1 NM, like the approach from the North at Palm Springs.

Under certain conditions like un-annunciated loss of Autopilot, loss of Autopilot might be considered a Major Hazard, in other words something that's likely to cause significant additional workload for the pilot or which considerably reduces the safety margin. For certification aircraft are designed so that Major Hazards occur at less than 10⁻⁷ probability per flight hour (i.e. less than once in the lifetime of a single aircraft, but as much as a few times in the lifetime of a whole fleet). For more typical flight scenarios annunciated loss of Autopilot functionality might be Minor, that is a slight reduction in safety margins.

A good resource for looking into questions like this is the NASA ASRS database, which returns several dozen reports of autopilot disengaging unexpectedly like ACN 1774748 or ACN 1781223. Although there is reporting bias there - any incident reported is going to be serious enough to file, but not fatal.

This analysis can be a little complicated, and guidelines like the Minimum Equipment List tell pilots what's certified for their aircraft, while standards like ARP4761 provide a framework that designers use to answer questions of "how bad is it if X fails?". Simple questions like "is yaw damper safety critical?" can vary depending on the design of the aircraft.

_{Keep in mind the term "autopilot" can be confusing. I'm not referring here to a Fly-By-Wire system which is clearly critical. I'm referring here to a system that computes and displays guidance commands, trims the aircraft, and may even command the control surfaces if there is a way for the pilot to override such control surface commands. Loss of some of those sub-functions by themselves, like trim, may not as bad as indicated above.}