How does an aircraft's autopilot work?

The autopilot does not "fly" the aircraft the way a person does: it runs a closed control loop. First it measures the aircraft's actual state using gyroscopes and accelerometers (today integrated into solid-state inertial units), the air data system (altitude, indicated airspeed, Mach number) and position from GPS or radio navigation aids. It then compares those values with the setpoint selected by the crew — maintaining 35,000 ft (10,670 m), following heading 270, or flying at Mach 0.78 — and calculates the correction needed. Finally, it moves the ailerons, elevator and rudder through servo actuators, or on fly-by-wire aircraft sends the command to the flight control computers. The cycle repeats dozens of times per second.

The simplest systems, typical of light aviation, act on a single axis: keeping the wings level or holding a heading. A two-axis autopilot adds pitch control (altitude and climb or descent), and a three-axis system adds the rudder to coordinate turns and damp yaw. On an airliner the whole package is called the flight guidance system and operates through modes: on the lateral axis it can hold a heading, follow a lateral route (LNAV) or capture a localizer; on the vertical axis, hold altitude, a vertical speed, a computed descent profile (VNAV) or a glide path. The autothrottle completes the set by regulating thrust to maintain the selected speed or power setting.

During an airline flight the autopilot is engaged shortly after takeoff and disengaged before touchdown, except on Category II or III approaches, where the redundant systems of a certified aircraft can guide it to the ground and keep it on the runway centerline during the landing roll. The crew never stops working: they program the FMS, select altitudes and speeds cleared by air traffic control, check that every active mode is the expected one, and stand ready to disconnect and fly by hand if something doesn't add up. Takeoff is always flown manually. Regulators also require that any system failure produce a clear disconnection and that residual control forces remain manageable, so the pilot can safely take back control.