[SomeHacker44]

(It is broken because:) When engaged, the altitude hold function commands a 10 degree pitch up attitude in all cases. This is a reasonably extreme pitch. Even the built in “take off/go around” mode usually commands only about 7-8 degrees nose up.

The altitude is “held” using a “static” pressure sensor and pitch is adjusted in a control and feedback loop to attempt to keep that signal constant. When it works, it is very smooth.

The system is not as a whole redundant, but there are many failsafes. You can put it into a mode where the system does not fly the plane but tells you what it thinks you should do. This is called a flight director. You fly it almost like a video game, get the pointers aligned.

Each component has some redundancy. It has a self test, an annunciator panel saying what mode it is in, a mode control panel, several controls on the yoke including a kill switch, several circuit breakers (one, the electric trim, which has a big red flange on it - see the recent 737 crash artickes), etc.

The workflow of using the autopilot is always command a change, check that the change is reflected on the annunciators and that the plane is adjusting attitude and such appropriately, then resume the normal scan. If at any time anything looks off my instant reaction is always to hit the big red button and take the plane’s control back. When you do this you need to be wary for an out of trim condition and other sudden forces on the yoke and rudder.