Autoland — Page 381, Lesson 467

I want to walk you through the Autoland chapter now. We're going to start with the two big safety classifications, because everything else in this chapter hangs off them. First, fail-passive, which is also called fail-soft. Here's the exact definition: it's the ability of the system to withstand a failure without endangering passenger safety, and without producing excessive deviations in the flight path — but it removes the system's capability to complete an automatic landing. So think of it this way: a failure happens, nobody gets hurt, the aircraft doesn't wander off the flight path dangerously, but the autoland is finished. The system can no longer finish the job itself. The minimum number of autopilots required for a fail-passive capability is two. Now the other classification: fail-operational, also called fail-active. This is defined as the ability of a system to withstand a failure without affecting the overall functioning of the system, and without causing degradation of performance beyond the limits required for automatic landing. So here, a failure occurs and the autoland just keeps going — the system still functions as a whole, and performance stays within the limits needed for the automatic landing. The system requires a minimum of three autopilots. But there's an important exception: it is possible for an aircraft to have a fail-operational category with only two autopilots, provided that there is suitable duplicate monitoring for each channel. So two autopilots can qualify as fail-operational, but only if each channel has its own duplicate monitoring. Now let's move into the automatic landing sequence itself, starting with the profile. During cruise and the initial stages of approach to land, the control system operates as a single channel system. It controls the aircraft about its pitch and roll axes, and it provides the appropriate flight director commands. The profile of an automatic approach, flare and landing sequence is shown in Figure 27.1, and it's based on a system that utilizes triple digital flight control computer channels. That triple redundancy is what allows the system to operate in the fail-operational and fail-passive conditions we just defined. Next, the status annunciator. Depending upon the number of channels that are armed and engaged, the system performs what are termed a 'LAND 2' status or a 'LAND 3' status autoland. So 'LAND 2' signifies there is dual redundancy of engaged flight control computers, sensors and servos — that's fail-passive operation. 'LAND 3' signifies triple redundancy of power sources, engaged flight control computers, sensors and servos — that's fail-operational. Each status is displayed on an autoland status annunciator. So the annunciator is the cockpit display that tells you which level of redundancy you're actually running on. Now, the approach phase. Since multi-channel operation is required for an automatic landing, at a certain stage of the approach the remaining two channels are armed by pressing an 'APPR' switch on the flight control panel. The operation of this switch also arms the localizer and glide slope modes. Both of the 'off-line' channels are continually supplied with the relevant outer loop control signals, and they operate on a comparative basis the whole time. So those channels that aren't yet engaged are still being fed the same signals, and they're constantly comparing their outputs — that's how they stay ready and how the system monitors itself. Finally, the radio altimeter. Altitude information essential for vertical guidance to touchdown is always provided by signals from a radio altimeter, which becomes effective as soon as the aircraft's altitude is within the altimeter's operating range — typically 2500 feet. So below that height, the radio altimeter is giving you the precise height above the ground that the autoland needs for the flare and touchdown. And there's a specific failure case I want you to know: AFS radio altimeter loss. Two independent radio altimeters provide RA — that's radio altitude — to the respective FCC, the flight control computers. The Captain's radio altimeter also provides RA information to the A/T, the autothrottle. So you have two independent sources, and the captain's side feeds both the flight control computer and the autothrottle. That's the redundancy structure you need to understand for this chapter.