I have read that some airplanes have multiple autopilots, specifically airliners.
What is the reason for this, and how does that system work?
Aviation Stack Exchange is a question and answer site for aircraft pilots, mechanics, and enthusiasts. It only takes a minute to sign up.
Sign up to join this communityI have read that some airplanes have multiple autopilots, specifically airliners.
What is the reason for this, and how does that system work?
Redundancy, particularly during autoland operations.
How it works depends on the specific airplane type. In the most advanced systems with triple (or more) flight guidance computers (FGCs), a "voting" concept is used during critical operations like autoland. All 3 computers calculate their commands independently, and vote on what to do. The middle value, or sometimes the average of the 2 "most similar" values, is then passed to the flight control actuators. In this way, if any one of the computers fails and starts producing garbage commands, those erroneous commands will not be selected (they are automatically rejected by the voting scheme). A monitoring system can also detect a failed computer in this way and take it offline, allowing "fail-active" functionality — an autoland can continue on the 2 remaining functional computers.
Less complex aircraft, and aircraft without autoland, still sometimes have 2 FGCs, but do not support fail-active operation. In these systems only one of the two computers is active or selected at any given time. A transfer switch in the cockpit allows the pilot to transfer control from one computer to the other if one fails.
And it's not just airliners. Business jets commonly also have dual FGCs, and in recent times even small general aviation airplanes like the Diamond DA-42 have dual systems (Garmin G1000 in dual-GFC700 configurations).
This photo (click for high res version) shows a Cessna Citation CJ business jet with dual Garmin autopilots. At the top of the PFD, notice there is a small green arrow pointing left; this indicates the left FGC is currently selected. The photo also shows the XFR (transfer) button on the mode select panel, top center, just underneath the master caution/warning annunciator panel. Pushing this button would switch to the right (#2) FGC and change the arrow on the PFD to point to the right. These indications are fairly representative of other dual-FGC systems.
Here's another photo of a Hawker 800 with Rockwell Collins Pro Line 21. You can see the same arrow on the PFDs. In this aircraft the transfer switch is labeled "AP XFR" and is again on the autopilot panel just underneath the glareshield at the top of the panel toward the left hand side.
And finally a photo of a 767 with 3 FGCs and full autoland capability. It's a bit hard to read in this photo, but just above the autopilot disengage bar (the "spacebar" looking thing on the right side of the mode select panel just under the glareshield) the 3 buttons are labeled "A/P ENGAGE", "L" "C" and "R" for the left, center and right FGCs. During an autoland all 3 would be selected and illuminated.
if any one of the computers fails and starts producing garbage commands
As the FGC is a piece of software, and all software is prone to bugs and errors, it is likely that any given FGC will produce garbage from time. The voting system prevents the plane from crashing when this happens.
$\endgroup$
Apr 16, 2014 at 21:06