Autoland — Page 381, Lesson 467

Let's start with the heart of autoland: the two failure categories that define what the system can and cannot do. I want you to hold these two definitions tightly, because everything else in this chapter hangs off them. First, fail-passive, which is also called fail-soft. The formal definition is this: it's the ability of the system to withstand a failure without endangering passenger safety, and without producing excessive deviations in the flight path — but it removes the system's capability to complete an automatic landing. So think of it this way: a failure happens, nobody gets hurt, the aircraft doesn't lurch off course, but the autoland is now finished. It can't finish the job. The minimum number of autopilots required for a fail-passive capability is two. Now the second category: fail-operational, also called fail-active. This is defined as the ability of a system to withstand a failure without affecting the overall functioning of the system, and without causing degradation of performance beyond the limits required for automatic landing. The key contrast here: in fail-passive, a failure kills the autoland. In fail-operational, a failure does not stop the autoland — the system keeps functioning and still meets the performance limits needed to land automatically. The system requires a minimum of three autopilots. However — and this is an important nuance — it is possible for an aircraft to have a fail-operational category with only two autopilots, provided there is suitable duplicate monitoring for each channel. So the three-autopilot rule is the standard, but with redundant monitoring on each of two channels, two can suffice. Now let's move into the automatic landing sequence itself. During cruise and the initial stages of approach to land, the control system operates as a single channel system. It controls the aircraft about its pitch and roll axes — pitch is the nose up and down, roll is the banking — and it provides the appropriate flight director commands. So early on, it's just one channel doing the work. The profile of an automatic approach, flare and landing sequence is shown in Figure 27.1, and it's based on a system that utilizes triple digital flight control computer channels. That triple redundancy is what allows the system to operate in the fail-operational and fail-passive conditions we just defined. Now, here's where the status naming comes in. Depending upon the number of channels that are armed and engaged, the system performs what are termed a 'LAND 2' status or a 'LAND 3' status autoland. So 'LAND 2' signifies there is dual redundancy of engaged flight control computers, sensors and servos — and that corresponds to fail-passive operation. 'LAND 3' signifies triple redundancy of power sources, engaged flight control computers, sensors and servos — and that corresponds to fail-operational. Each status is displayed on an autoland status annunciator — that's the indicator that tells the crew which level of redundancy is actually active. Now, the approach phase. Since multi-channel operation is required for an automatic landing, at a certain stage of the approach the remaining two channels are armed by pressing an 'APPR' switch on the flight control panel. The operation of this switch also arms the localizer and glide slope modes — localizer gives you lateral guidance, glide slope gives you vertical guidance. Both of the 'off-line' channels are continually supplied with the relevant outer loop control signals and operate on a comparative basis the whole time. So those two channels that aren't yet engaged are still being fed the same signals and are constantly comparing their outputs, ready to take over. Finally, the radio altimeter. Altitude information essential for vertical guidance to touchdown is always provided by signals from a radio altimeter, which becomes effective as soon as the aircraft's altitude is within the altimeter's operating range — typically 2500 feet. So below that height, the radio altimeter is giving you the precise height above the ground needed for the flare. And there's a specific note about AFS radio altimeter loss. Two independent radio altimeters provide RA — that's radio altitude — to the respective FCC, the flight control computer. The Captain's radio altimeter also provides RA information to the A/T, the autothrottle. So each flight control computer gets its own radio altimeter feed, and the autothrottle gets its feed from the Captain's side. So the whole picture: two failure categories define the safety envelope, triple redundancy gives you fail-operational, dual gives you fail-passive, the APPR switch arms the extra channels, and the radio altimeter provides the vertical truth down to touchdown.