Autoland
In aviation, autoland describes a system that fully automates the landing procedure of an aircraft's flight, with the flight crew supervising the process. Such systems enable airliners to land in weather conditions that would otherwise be dangerous or impossible to operate in.
A few general aviation aircraft have begun to be fitted with "emergency autoland" systems that can be activated by passengers, or by automated crew monitoring systems. The emergency autoland systems are designed to complete an emergency landing at the nearest suitable airport, without any further human intervention, in the event that the flight crew is incapacitated.
Description
Autoland systems were designed to make landing possible in visibility too poor to permit any form of visual landing, although they can be used at any level of visibility. They are usually used when visibility is less than 600 meters runway visual range and/or in adverse weather conditions, although limitations do apply for most aircraft—for example, for a Boeing 747-400 the limitations are a maximum headwind of 25 kts, a maximum tailwind of 10 kts, a maximum crosswind component of 25 kts, and a maximum crosswind with one engine inoperative of five knots. They may also include automatic braking to a full stop once the aircraft is on the ground, in conjunction with the autobrake system, and sometimes auto deployment of spoilers and thrust reversers.Autoland may be used for any suitably approved instrument landing system or microwave landing system approach, and is sometimes used to maintain currency of the aircraft and crew, as well as for its main purpose of assisting an aircraft landing in low visibility and/or bad weather.
Autoland requires the use of a radar altimeter to determine the aircraft's height above the ground very precisely so as to initiate the landing flare at the correct height. The localizer signal of the ILS may be used for lateral control even after touchdown until the autopilot is disengaged. For safety reasons, once autoland is engaged and the ILS signals have been acquired by the autoland system, it will proceed to landing without further intervention.
It can be disengaged only by completely disconnecting the autopilot or by initiating an automatic go-around. At least two and often three independent autopilot systems work in concert to carry out autoland, thus providing redundant protection against failures. Most autoland systems can operate with a single autopilot in an emergency, but they are only certified when multiple autopilots are available.
The autoland system's response rate to external stimuli work very well in conditions of reduced visibility and relatively calm or steady winds, but the purposefully limited response rate means they are not generally smooth in their responses to varying wind shear or gusting wind conditions – i.e., not able to compensate in all dimensions rapidly enough – to safely permit their use.
The first aircraft to be certified to CAT III standards, on 28 December 1968, was the Sud Aviation Caravelle, followed by the Hawker-Siddeley HS.121 Trident in May 1972 and to CAT IIIB during 1975. The Trident had been certified to CAT II on 7 February 1968. Besides providing automatic landing, automatic ground roll and extensive en route facilities, the Trident's AFCS also provided automatic overshoot which was essential for Cat II operation, PVD ground roll guidance for take-off in 100 metres runway visual range and as back up to the ‘fail-soft’ automatic rudder control system during Cat. IIIB landings, and a Ground Run Monitor for measuring ground speed and distance travelled as an aid for estimating runway turn-off points and taxying.
Autoland capability has seen the most rapid adoption in areas and on aircraft that must frequently operate in very poor visibility. Airports troubled by fog on a regular basis are prime candidates for Category III approaches, and including autoland capability on jet airliners helps reduce the likelihood that they will be forced to divert by bad weather.
Autoland is highly accurate. In his 1959 paper, John Charnley, then Superintendent of the UK Royal Aircraft Establishment's Blind Landing Experimental Unit, concluded a discussion of statistical results by saying that "It is fair to claim, therefore, that not only will the automatic system land the aircraft when the weather prevents the human pilot, it also performs the operation much more precisely".
Previously, autoland systems have been so expensive that they were rarely used on small aircraft. However, as display technology has developed, the addition of a head up display allows for a trained pilot to manually fly the aircraft using guidance cues from the flight guidance system. This significantly reduces the cost of operating in very low visibility, and allows aircraft that are not equipped for automatic landings to make a manual landing safely at lower levels of look ahead visibility or runway visual range. In 1989, Alaska Airlines was the first airline in the world to manually land a passenger-carrying jet in FAA Category III weather made possible with the head-up guidance system.
History
Background
Commercial aviation autoland was initially developed in the United Kingdom, as a result of the frequent occurrence of very low visibility conditions in winter in Northwest Europe. These occur particularly when anticyclones are in place over Central Europe in November/December/January when temperatures are low, and radiation fog easily forms in relatively stable air. The severity of this type of fog was exacerbated in the late 1940s and 1950s by the prevalence of carbon and other smoke particles in the air from coal burning heating and power generation.Cities particularly affected included the main UK centers, and their airports such as London Heathrow, London Gatwick, Manchester, Birmingham and Glasgow, as well as European cities such as Amsterdam, Brussels, Paris, Zurich and Milan. Visibility at these times could become as low as a few feet and, when combined with the soot, created lethal long-persistence smog. These conditions led to the passing of the UK's "Clean Air Act," which banned the burning of smoke-producing fuel.
During the immediate post-war period, British European Airways suffered a number of accidents during approach and landing in poor visibility, which caused it to focus on the problems of how pilots could land safely in such conditions. A major breakthrough came with the recognition that in such low visibility the very limited visual information available was extraordinarily easy to misinterpret, especially when the requirement to assess it was combined with a requirement to simultaneously fly the aircraft on instruments. This led to the development of what is now widely understood as the "monitored approach" procedure.
One pilot is assigned the task of accurate instrument flying while the other assesses the visual cues available at decision height, taking control to execute the landing once satisfied that the aircraft is in fact in the correct place and on a safe trajectory for a landing. The result was a major improvement in the safety of operations in low visibility, and as the concept clearly incorporates vast elements of what is now known as crew resource management it was expanded to encompass a far broader spectrum of operations than just low visibility.
However, associated with this "human factors" approach was a recognition that improved autopilots could play a major part in low-visibility landings. The components of all landings are the same, involving navigation from a point at altitude en route to a point where the wheels are on the desired runway. This navigation is accomplished using information from either external, physical, visual cues, or from synthetic cues such as flight instruments. At all times, there must be sufficient total information to ensure that the aircraft's position and trajectory are correct.
The problem with low visibility operations is that the visual cues may be reduced to effectively zero, and hence there is an increased reliance on "synthetic" information. The dilemma faced by BEA was to find a way to operate without cues, because this situation occurred on its network with far greater frequency than on that of any other airline. It was particularly prevalent at its home base, London Heathrow, which could effectively be closed for days at a time.
Development of autoland
The United Kingdom government's aviation research facilities including the Blind Landing Experimental Unit set up during 1945/46 at RAF Martlesham Heath and RAF Woodbridge to research all the relevant factors. BEA's flight technical personnel were heavily involved in BLEU's activities in the development of Autoland for its Trident fleet from the late 1950s. The work included analysis of fog structures, human perception, instrument design, and lighting cues amongst many others. After further accidents, this work also led to the development of aircraft operating minima in the form we know them today. In particular, it led to the requirement that a minimum visibility must be reported as available before the aircraft may commence an approach – a concept that had not existed previously. The basic concept of a "target level of safety" and of the analysis of "fault trees" to determine probability of failure events stemmed from about this period.The basic concept of autoland flows from the fact that an autopilot could be set up to track an artificial signal such as an Instrument Landing System beam more accurately than a human pilot could – not least because of the inadequacies of the electro-mechanical flight instruments of the time. If the ILS beam could be tracked to a lower height then clearly the aircraft would be nearer to the runway when it reached the limit of ILS usability, and nearer to the runway less visibility would be required to see sufficient cues to confirm the aircraft position and trajectory. With an angular signal system such as ILS, as altitude decreases all tolerances must be decreased – in both the aircraft system and the input signal – to maintain the required degree of safety.
This is because certain other factors – physical and physiological laws which govern for example the pilot's ability to make the aircraft respond – remain constant. For example, at 300 feet above the runway on a standard 3 degree approach the aircraft will be 6000 feet from the touchdown point, and at 100 feet it will be 2000 feet out. If a small course correction needs 10 seconds to be effected at 180 kts it will take 3000 ft. It will be possible if initiated at 300 feet of height, but not at 100 feet. Consequently, only a smaller course correction can be tolerated at the lower height, and the system needs to be more accurate.
This imposes a requirement for the ground-based, guidance element to conform to specific standards, as well as the airborne elements. Thus, while an aircraft may be equipped with an autoland system, it will be totally unusable without the appropriate ground environment. Similarly, it requires a crew trained in all aspects of the operation to recognize potential failures in both airborne and ground equipment, and to react appropriately, to be able to use the system in the circumstances for which it is intended. Consequently, the low visibility operations categories apply to all 3 elements in the landing – the aircraft equipment, the ground environment, and the crew. The result of all this is to create a spectrum of low visibility equipment, in which an aircraft's autoland autopilot is just one component.
The development of these systems proceeded by recognizing that although the ILS would be the source of the guidance, the ILS itself contains lateral and vertical elements that have rather different characteristics. In particular, the vertical element originates from the projected touchdown point of the approach, i.e., typically 1000 ft from the beginning of the runway, while the lateral element originates from beyond the far end. The transmitted glideslope therefore becomes irrelevant soon after the aircraft has reached the runway threshold, and in fact the aircraft has of course to enter its landing mode and reduce its vertical velocity quite a long time before it passes the glideslope transmitter. The inaccuracies in the basic ILS could be seen in that it was suitable for use down to 200 ft. only, and similarly no autopilot was suitable for or approved for use below this height.
The lateral guidance from the ILS localizer would, however, be usable right to the end of the landing roll, and hence is used to feed the rudder channel of the autopilot after touchdown. As aircraft approach the transmitter, its speed is obviously reducing and rudder effectiveness diminishes, compensating to some extent for the increased sensitivity of the transmitted signal. More significantly, however, it means the safety of the aircraft is still dependent on the ILS during rollout. Furthermore, as it taxis off the runway and down any parallel taxiway, it itself acts a reflector and can interfere with the localizer signal. This means that it can affect the safety of any following aircraft still using the localizer. As a result, such aircraft cannot be allowed to rely on that signal until the first aircraft is well clear of the runway and the "Cat. 3 protected area".
The result is that when these low visibility operations are taking place, operations on the ground affect operations in the air much more than in good visibility, when pilots can see what is happening. At very busy airports, this results in restrictions in movement which can in turn severely impact the airport's capacity. In short, very low visibility operations such as autoland can only be conducted when aircraft, crews, ground equipment and air and ground traffic control all comply with more stringent requirements than normal.
The first "commercial development" automatic landings were achieved through realizing that the vertical and lateral paths had different rules. Although the localizer signal would be present throughout the landing, the glide slope had to be disregarded before touchdown in any event. It was recognized that if the aircraft had arrived at decision height on a correct, stable approach path – a prerequisite for a safe landing – it would have momentum along that path. Consequently, the autoland system could discard the glideslope information when it became unreliable, and use of pitch information derived from the last several seconds of flight would ensure to the required degree of reliability that the descent rate would remain constant. This "ballistic" phase would end at the height when it became necessary to increase pitch and reduce power to enter the landing flare. The pitch change occurs over the runway in the 1000 horizontal feet between the threshold and the glide slope antenna, and so can be accurately triggered by radio altimeter.
Autoland was first developed in BLEU and Royal Air Force aircraft such as the English Electric Canberra, Vickers Varsity and Avro Vulcan, and later for BEA's Trident fleet, which entered service in the early 1960s. The Trident was a 3-engined jet built by de Havilland with a similar configuration to the Boeing 727, and was extremely sophisticated for its time. BEA had specified a "zero-visibility" capability for it to deal with the problems of its fog-prone network. It had an autopilot designed to provide the necessary redundancy to tolerate failures during autoland, and it was this design which had triple redundancy.
This autopilot used three simultaneous processing channels each giving a physical output. The fail-safe element was provided by a "voting" procedure using torque switches, whereby it was accepted that in the event that one channel differed from the other two, the probability of two similar simultaneous failures could be discounted and the two channels in agreement would "out-vote" and disconnect the third channel. However, this triple-voting system is by no means the only way to achieve adequate redundancy and reliability, and in fact soon after BEA and de Havilland had decided to go down that route, a parallel trial was set up using a "dual-dual" concept, chosen by BOAC and Vickers for the VC10 4-engined long range aircraft. This concept was later used on the Concorde. Some BAC 1-11 aircraft used by BEA also had a similar system.