AIRCRAFT CAPABILITY
In order to Autoland an aircraft needs to have an Autoland system, not all aircraft do, typically smaller turboprop aircraft and some older regional jets, and some operators of aircraft capable of it refuse to pay for the cost of the certification, training and maintenance programmes required by operators in order to have and to hold the certification to carry out such manoeuvres. This is typically due to the cost benefit in their operation where such conditions are one off events. Typically these operators will conduct training and obtain approvals to operate to CAT II limits in order to offer some protection to their operation. Again, this is operator to operator dependant, and some won’t bother.
For aircraft with Autoland systems installed, these are normally integrated within the suite of autopilot functions. The aircraft manufacturer will have flight tested these functions during the type design certification process with the relevant worldwide authorities in states with operators that the type is to be sold to.
Typically an Autoland system falls into two distinct groups;
- FAIL PASSIVE
- FAIL OPERATIONAL
A FAIL PASSIVE autopilot is one whereby a failure of the system or any ground based component (ILS signal) won’t leave the Aircraft misbehaving or give any out-of-trim handling condition to the Pilot. That back up is indeed the Pilot should the system suffer a failure.
A FAIL OPERATIONAL autopilot is one whereby any failure is contained within the system and the functions continue to operate. The downgrade due to an internal failure is to the status of FAIL PASSIVE. Should a further failure occur the final back up is the Pilot.
In order to conduct operations in CAT III weather conditions and to make use of CAT III airfield systems, and aircraft needs to have an Autoland system of either of the above types.
The typical weather minima with these systems are shown below for a UK airfield
As you can see there are a number of options to choose from and these are dependent on what the aircraft is capable of on the day. Assuming no qualification issues or airfield equipment deficiencies we can with a FAIL OPERATIONAL Autoland system (assume B787) fly down to a minima of 75m visibility and no decision height. Should some of the lighting for example be unserviceable there is a table we consult that points us to the lowest allowable minima on that table we can use given that failure.
If CAT III facilities are no longer available but CAT II and CAT I is available and the weather allows that (more of which in a bit) we can use this table.
A big part of FAIL OPERATIONAL autopilots is the presence of a certification requirement known as the ‘Alert Height’. This is a height that isn’t called out or made known during an Autoland approach but exists in a manual as a value. This typically is around 100ft above ground for Airbus and 200ft for Boeings.
The Alert height is significant in the handling of defects during the most critical point of the approach. Essentially below it, if we hear an alert from the aircraft we go-around, above it we can elect to go-around or handle any degradation by selecting a higher and more limiting minima should the weather conditions allow. For some failures only a go-around and reassessment of the aircraft’s capability is allowed. All of this is detailed in the relevant aircraft manuals.
The Alert Height is a certification requirement and must be above the MABH or Minimum Approach Break-off Height. This is a height from which, assuming normal handling characteristics and with zero reference to the outside environment, the aircraft should not touch the ground if a go-around is commenced. It is linked with the altitude loss from this height to commence the go-around and forms part of the certification basis for the minima approved for use by the state aviation authorities.
When assessing an aerodrome for CAT II/III operations, all of this will be taken into account by the airline and the authority in question. The airline will submit their proposal to the authority and it is they who will approve, or offer and amended authorisation for those operations. Part of this approval is demonstrating a company’s aircraft can indeed Autoland on that specific runway as we gain approval on a runway by runway basis, and not generically for an airfield. We often see notes on pilot briefing packages asking us to conduct one in good weather and report back on the success or otherwise of the approach and landing.
For example at JFK, we can not Autoland or conduct low visibility operations on all of the runways, the runways are neither equipped for the function and the approaches in use preclude it.
Some examples of types that have fail passive autolands are the B737-300/400/500 series and the EMB190.
Examples of fail operational aircraft are everything BA mainline currently operate. So all of the B777/787 and Airbus family aircraft.
Fail Passive aircraft can only operate down to CAT IIIA limits, and fail operational can operate down to CAT IIIB plus C albeit IIIC is not authorised or used in Europe.
The aircraft is constantly monitoring itself and will report at any point in the flight a degradation in its landing capability. For the majority of the time a Boeing wide body is capable of CAT IIIB operation and this is indicated by the lack of a NO LAND 3 message on the aircraft’s EICAS and the presence on the PFD of a LAND 3 below 1500ft radio altimeter height above the ground.
On airbus the PFD would indicate CAT 3 DUAL.
Should during the course of the flight an internal failure occur, depending on the nature there may be a system degradation to create a fail passive Autoland. This would be annunciated by the presence of the NO LAND 3 message on a Boeing and the LAND 3 would become a LAND 2. This signifies to the crew that they are now only able to proceed down to CAT IIIA limits at best.
With all of this in mind, lets see how the operation works in practise.