Why would autopilot be prohibited below 1000 feet AGL?

Question

Came across this airplane on controller. It has a label on the panel that says: "Autopilot prohibited below 1000' AGL".

---

Why?

(source)

Answer 1

Due to regulatory reasons.

From a purely technical standpoint the autopilot does not care about your height, it works just fine at every altitude (of course the aircraft cannot go above it service ceiling or below ground...).

However, from a regulatory standpoint some APs are only certified for operation above some minimal altitude, e.g. to avoid controlled flight into terrain situations. Without knowing the exact reasoning of this AP, reasons can involve:

• The AP cannot guarantee that its engagement will not let the aircraft sink for a couple of 100 ft before recovering. With safety margin this zone extends 1000 ft
• The AP does not feature a ground altimeter. Therefore it does not know how high above ground it is, therefore it cannot adapt its behavior close to ground. This does not fulfill the safety requirements, therefore this limit.
• If the AP encounters a fault, the pilot shall be granted enough time to take over control. For example, if the autopilot does not feature enough redundancy to guarantee that it performs with acceptable risk under all possible fault cases, the AP is simply restricted to a minimum altitude. This way, the pilot can take over control when the AP fails and still has enough altitude to recover the aircraft.

Certification is expensive, therefore such trade offs in operational limits are often accepted in aviation products to keep the cost low.

Answer 2

FAA Advisory Circular AC 23-17C describes procedures and requirements for certifying aircraft under part 23.

The autopilot section, (23.1329, starting on page 250) says in part:

A single malfunction may not result in a hardover signal in more than one axis.

And:

The results of malfunction testing determine which flight condition is most critical. The effects of autopilot runaways are more pronounced at aft CG. Also, the phase of flight with the largest contribution to adverse conditions varies with airplane model.

Typically the most critical flight condition would be in approach configuration down low, and a erroneous full nose-down command from the autopilot. This condition is tested, (starting out at higher altitudes and incrementally stepping down...) at both forward and aft CG limitations.

A recognition/reaction delay from the pilot is considered, and the altitude lost in recovery is noted. From there an appropriate safety margin is calculated to establish the no-lower-than limitation.