How the 747 flies itself

A 747 is not simply equipped with an autopilot. It has a whole automatic flight system - a set of computers, two independent flight directors and an autothrottle that share a single set of knobs in the glareshield, and the whole arrangement exists so that the crew spends its attention on flying the aeroplane rather than on moving surfaces.

The Mode Control Panel

Everything the crew commands sits in the MCP, in the glareshield between the two pilots. It is arranged in labelled blocks: autothrottle, speed, heading, vertical speed, altitude, approach, and the autopilot master switches.

Engaging the autopilot is deliberately a two-hand proposition. Pushing one of the three A/P ENGAGE switches commands CMD, but the mode that engages is whatever the flight directors and mode switches have already selected. Push the switch with the flight directors off and you get a basic mode - vertical speed in pitch, and heading hold or attitude hold in roll, depending on how much bank angle is on the aircraft when you do it.

The disengage bar spanning the panel is the emergency countermeasure. Pushing it down trips all three autopilots at once and blocks them from re-engaging until it is lifted. A pilot can also disconnect a single channel by pulling the control column backwards against its feel, and the EICAS displays AUTOPILOT DISC whenever any of this happens.

Two flight directors, three autopilots

The two flight directors are the part that computes the guidance. They do not move anything; they draw the little command bars on the primary flight displays showing where the aircraft ought to be pointing.

The distinction matters for understanding the redundancy. Two flight directors can be driving guidance, and a single autopilot channel can fly the aircraft from that guidance. That is why the original 747-100, -200 and -300 - which had two autopilots, channels A and B - could be used for an automatic landing only with both channels engaged.

The 747-400 and 747-8 added a third channel, and that extra channel buys a specific certification level, expressed on the displays as:

Annunciation	Meaning
LAND 3	All three autopilots engaged. Fail operational - a single fault cannot prevent an automatic landing
LAND 2	Redundancy reduced to two channels. Fail passive - a single fault cannot cause a significant deviation
NO AUTOLAND	The system cannot make an automatic landing at all

The distinction between the first two is a real engineering line, not a label. A UK investigation of an automatic landing on a 747-236B found the A channel dropped out by itself at 1,000 ft radio height; the approach continued and landed normally on two channels, which is exactly the case LAND 2 is designed to cover. The same report describes how the redundancy actually works in service: during an automatic landing the output commands of all three channels are continuously compared and the mid value is used to control the aircraft, so a single channel that strays is outvoted rather than obeyed.

What happens in the flare

At 1,000 ft radio height, with the localiser and glideslope captured, something changes hands. Control of the aircraft passes from the pitch and roll computers to the Landing Control Logic Units, which take over the approach, landing and automatic flare using radio height and its rate of change.

At 50 feet the FLARE indication on the flight mode annunciator turns from white to green, confirming the flare has begun. That same investigation found a real limitation: at 50 feet, with the aircraft nearly stopped, the control column could move backwards when it should not have, producing an unexpected nose-down pitch rate during the flare. The autopilot was passed for a triple-autopilot landing after investigation and modification.

One asymmetry is built in deliberately. Below 200 feet radio height a change from LAND 3 to LAND 2 is not annunciated, because there is no time left to act on the information.

The autothrottle is mechanical

The autothrottle is not a fly-by-wire system, and this is a detail that surprises people. It works by engaging a clutch to move the throttle levers - the levers are physically driven, and they move in the cockpit where both pilots can see them.

Its modes are the first column of the flight mode annunciator:

Mode	What it does
SPD	Holds the commanded airspeed or Mach number from the MCP or the flight management computer
THR REF	Holds the thrust reference displayed on the EICAS
THR CLB	The climb rating, selected before the thrust reduction altitude
IDLE	Pulls the levers back to idle, normally at the top of descent; then HOLD
HOLD	The clutch is released; the crew has the levers and the current thrust is maintained

HOLD is what makes the system safe to touch. In SPD the levers are held where the autothrottle put them, but in HOLD a pilot can move them freely.

Because the levers are real, the crew always has a way out. Moving the levers to idle disconnects the autothrottle. The A/T ARM switch also disconnects it automatically if more than one engine is inoperative.

What a mode failure does

Failures are handled according to scope, and the crew is told which case applies. A failure affecting only the active mode leaves the autopilot engaged in an attitude-stabilising mode, with an amber line struck through that mode's annunciation on the primary flight display and an AUTOPILOT caution on the EICAS. A failure affecting all modes results in an autopilot disengagement with an aural warning.

That is the design in miniature: degrade to something simpler but keep flying, and make the degradation visible, rather than failing silently.

Related

• EICAS - where the warnings and thrust references appear
• Flight controls - the surfaces the autopilot commands
• Flight deck - what the crew sees
• 747 systems