Autoland — Page 381, Lesson 470

Let’s start with the big picture, because autoland is one of the most safety-critical things you’ll ever fly. The whole point is that the aircraft lands itself, with you monitoring, when visibility is so poor you can’t see the runway. And the very first thing I want you to understand is the golden rule that governs the entire system: with a radio altimeter inoperative, do not use the associated FCC or the A/T, if affected, for approach and landing. Let me unpack that. The radio altimeter is the sensor that measures your height above the ground using radio waves — it’s the only altimeter that gives you true height above terrain, not pressure altitude. The FCC is the Flight Control Computer — that’s the brain that actually flies the autopilot. The A/T is the autothrottle, which manages engine thrust. So the rule is: if one radio altimeter fails, you must not use the flight control computer that’s paired with it, nor the autothrottle if it’s affected, for the approach and landing. And here’s the critical consequence: failure of a single radio altimeter causes the autoland system to fail passive. Now, "fail passive" is a term you need to know cold. It means that if the system fails, it simply stops commanding — it doesn’t fight you, it doesn’t drive the aircraft into the ground. The autopilot just gives up control and hands it back to you, the pilot. So a single radio altimeter failure means the autoland is no longer available — you can’t continue the automatic landing. That’s the safety philosophy: one sensor failure, and the system degrades to passive, meaning it won’t do anything dangerous, but it also won’t land the plane for you. Now let’s walk through the actual sequence, using a Boeing aircraft as the example. The sequence starts with the Approach (APP) mode. The approach mode arms the AFDS — that’s the Automatic Flight Director System — to capture and track the localizer and glide slope. Let me define those: the localizer is the ILS lateral guidance that keeps you aligned with the runway centerline, and the glide slope is the vertical guidance that keeps you on the correct descent path down to the runway. "Arm" means the system is ready and waiting to engage when it sees the signal — it’s not active yet, but it’s standing by. Here’s a key point: the approach mode can be engaged for dual or single autopilot operation, but autoland requires dual. You cannot do an automatic landing with just one autopilot — you need both. So I’m going to describe the dual autopilot approach first, because that’s the one that actually lands the aircraft. In dual operation, approach mode allows both A/Ps to be engaged at the same time. And this is where the fail-passive concept comes back in a different form. Dual A/P operation provides fail-passive control through landing flare and touchdown or an automatic go-around. The flare is that final nose-up rotation just before touchdown that reduces your descent rate. A go-around is when you abort the landing and climb away. So with two autopilots, you get fail-passive control all the way through the flare, touchdown, or a missed approach. And here’s the clever bit about how fail-passive works with two autopilots: during fail-passive operation, the flight controls respond to the A/P commanding the least control movement. Think about that. If one autopilot fails and starts commanding something crazy, the other one is commanding something sane. The system compares them and always obeys the one asking for the smaller movement. So a failed autopilot can never yank the aircraft into a dangerous attitude — the healthy one, commanding less, wins. That’s how you get fail-passive with redundancy. Now, before you can even select approach mode, there’s a prerequisite: one VHF Nav receiver must be tuned to an ILS frequency. The VHF Nav receiver is the radio that receives the ILS signals. ILS is the Instrument Landing System — the ground-based system that transmits the localizer and glide slope. So you need at least one receiver tuned to the ILS frequency. And for a dual A/P approach, there’s an additional requirement: the second VHF NAV receiver must be tuned to the ILS frequency and the corresponding A/P engaged prior to 800 ft RA. RA is radio altitude — your height above the ground. So before you descend to 800 feet above the ground, you must have the second receiver tuned and the second autopilot engaged. That’s a hard timing constraint. Let’s move to the arming phase. After you set the localizer frequency and course, you press the APP switch to select approach mode. When you do, the APP switch illuminates — the button lights up — and VOR LOC and G/S armed is annunciated. VOR LOC is the localizer signal, and G/S is the glide slope. "Annunciated" means it’s displayed to you, typically on the flight mode annunciator — that’s the panel that tells you what the autopilot is doing. So you see "VOR LOC armed" and "G/S armed" — the system is standing by to capture both. Now, the APP mode also permits selecting the engagement of the second A/P. This is important: this arms the second A/P for automatic engagement after LOC and G/S capture and when descent below 1500 ft RA occurs. So the second autopilot doesn’t just turn on immediately — it’s armed, and it will automatically engage once two conditions are met: you’ve captured both the localizer and glide slope, and you’ve descended below 1500 feet radio altitude. Here’s a flexibility point: the localizer can be intercepted in the HDG SEL, CWS R or L Nav modes. Let me define those. HDG SEL is heading select — you’re flying a manually selected heading. CWS is control wheel steering — you’re hand-flying but the autopilot is assisting, and R or L just means right or left. L Nav is lateral navigation — navigating along a defined lateral path. So you can be in any of those modes and still intercept the localizer. And here’s another point: either the LOC or G/S can be captured first, although it’s most common to capture the localizer first, then the glide slope. So the sequence isn’t rigid — the system is flexible about which one you grab first. Now let’s look at the actual capture events. Localizer capture — the point where the system actually locks onto the localizer — is variable and depends on the intercept angle and rate of closure, but does not occur at less than ½ a dot deviation. Let me explain "dot deviation." On the course deviation indicator, the localizer needle moves in dots — a full-scale deflection is typically 2.5 dots. So half a dot is a small but meaningful deviation from centerline. The capture point depends on how steeply you’re intercepting and how fast you’re closing on the centerline, but the system will never capture before you’re within half a dot of center. That’s the minimum. When LOC capture happens, several things occur simultaneously: VOR LOC annunciates captured — the display changes from "armed" to "captured." 1 CH is annunciated for the A/P status — that’s telling you the autopilot is now in a specific channel or mode, channel 1. The previous roll mode disengages — whatever was controlling your bank, like heading select, turns off. And the aeroplane turns to track the LOC — it now steers to stay on the localizer centerline. Now glide slope capture. The G/S can be captured from above or below, although from below is generally preferred — that’s a technique point, capturing from below is the standard practice. Capture occurs at 2/5 dot deviation. So the glide slope captures at two-fifths of a dot — a smaller deviation than the localizer’s half-dot minimum. When G/S capture happens: G/S annunciates captured, the previous pitch mode disengages — whatever was controlling your pitch, like altitude hold, turns off. The APP switch light extinguishes if the localizer has also been captured — so if both are locked on, the approach mode light goes out, telling you the approach is now fully active. The aeroplane pitch tracks the G/S — it now follows the glide slope vertically. And the annunciated N1 thrust limit for the A/T is GA. Let me unpack that. N1 is the fan speed of the engine — the primary thrust parameter on a turbofan. A/T is the autothrottle. GA is go-around thrust. So when you capture the glide slope, the autothrottle’s thrust limit is set to go-around thrust — meaning the autothrottle is now allowed to command up to go-around power if needed. That’s the thrust ceiling for the approach. Now, once both the localizer and glide slope are captured, there’s a constraint on how you can exit the approach mode. After LOC and G/S are both captured, the APP mode can be exited only by pressing the TOGA switch or by disengaging the A/P and turning off both FD switches or re-tuning a VHF Nav receiver. Let me define TOGA — that’s Takeoff/Go-Around — the switch that commands a go-around. FD is the flight director — the command bars that show you the guidance. So you have three ways out: press TOGA to go around, or disengage the autopilot and turn off both flight director switches, or re-tune a VHF Nav receiver — which would break the ILS signal. Those are your only exits once you’re locked on. And finally, there’s a failure condition to know: after localizer and glide slope capture, the A/Ps will disengage and the FD command bars will retract to indicate an invalid ILS signal. So if the ILS signal becomes invalid — say the ground station fails or the signal is corrupted — the autopilots will disconnect, and the flight director command bars will retract, meaning they disappear from view. That retraction is your cue: the guidance is no longer valid, and you’re on your own. So let me tie this together. The autoland sequence is: arm the approach mode with the ILS tuned, capture the localizer at no less than half a dot, capture the glide slope at two-fifths of a dot, arm and engage the second autopilot below 1500 feet radio altitude, and then fly fail-passive all the way through the flare and touchdown — with the rule that a single radio altimeter failure kills the whole thing and makes it fail passive. That’s the foundation. From here, we’ll move into the categories of low-visibility landing capability, which build directly on this dual-autopilot, fail-passive concept.