For an automatic flight control system to be capable of automatic landing it must meet certain criteria. As has already been stated, it must contain a minimum of two independent autopilot systems and, in addition, it must satisfy the following safety requirements:
. The response of the system must be such that there will be no deviation from the flight path in the event of external disturbance such as turbulence or windshear.
. Control system faults must be indicated to the pilot as a warning or alert. . Control system failures must not cause the aircraft to deviate from the
flight path.
. The flight control system must have sufficient control authority to ensure accurate maintenance of the flight path.
. The effect of a servomotor runaway must be limited, such that safe recovery by the pilot is not jeopardised.
. The automatic flight control system must not prevent completion of the intended landing manoeuvre in the event of a system failure.
The above criteria are met by incorporating redundancy in the flight control system through duplication or triplication of the autopilot systems, so that a single failure within the system has a minimal effect on the overall aircraft performance during approach and landing. Depending upon the degree of redundancy, the autoland system is classified as being either a fail passive (fail soft) system or a fail operational (fail active) system.
Fail passive system
An automatic flight system is considered to be fail passive if there is no significant deviation from the flight path, or out-of-trim condition, following
a failure within the system, but the landing cannot be completed under automatic control. In simple terms it means that, if one of the autopilots fails, the other will disengage (since two are required for completion of an auto- matic landing), but there will be nothing to prevent the pilot completing the landing manually. It follows from this that an automatic flight control sys- tem incorporating two independent autopilots must be a fail passive system. Furthermore, a self-monitoring system is essential to ensure that both autopilots are in agreement at all times. These are the minimum require- ments for the multiplex type of control system necessary to meet autoland certification.
In the event of failure of either autopilot or the monitoring system during an automatic approach, the approach will continue on one autopilot, but automatic landing is no longer possible. The flight crew must take over manual control and revert to category 1 minima for landing, either continuing the landing or executing go-around procedures at decision height. The single autopilot will disengage automatically at about 350 ft radio altitude. Fail operational system
In order for a landing to be completed automatically, following a failure within the system, it follows that there must be at least three independent autopilots and two independent monitoring systems. A single failure in either of these will render the system fail passive, but it still has sufficient redundancy to meet the criteria for completion of an automatic landing. In a fail operational system all the autopilots and self-monitoring systems must be engaged for an automatic approach and landing.
The EFIS display indicates the number of engaged autopilots, with a caption reading LAND 3 indicating three autopilots engaged and a fail operational system, LAND 2 a fail passive system with two autopilots engaged and LAND 1 a passive failure with automatic disengagement pending and completion of the automatic landing impossible. At all other flight phases only one autopilot may be engaged at a time.
In the case of fail operational systems there is a specified alert height, determined by the performance of the aircraft and the automatic landing system. Failure of a redundant autopilot or monitoring system above this radio altitude will result in discontinuance of the automatic landing. If failure occurs below alert height the automatic landing is continued on the remaining autopilot, on the basis that manual reversion is more hazardous at this late phase (typically below decision height for manual completion of landing) than to continue in automatic control.
Automatic landing sequence
The sequence of events during an automatic landing is illustrated in Figure 5.14. The radio altitudes for the events during the final stages of the
off-line autopilots engaged flare mode ar
med
glideslope and localiser captured
nose-up tr
im
flare mode engaged 2 ft/sec descent path thr
ust le
v
er
retard
flare mode disengages nose-do
wn
command
roll-out autothrottle disengages with selection of re
v
erse thr
ust
AFDS remains until disengaged by flt cre
w touchdo wn 45 ft gear altitude 330 ft radio altitude 1500 ft radio altitude Figure 5.14 Automatic landing sequence.
approach to touchdown will vary according to aircraft size and perfor- mance, but the sequence is typical for most aircraft types.
During the descent from the cruise, approach mode is selected by depressing the APP pushbutton and this arms the off-line autopilots; the second in the case of a fail passive system and the second and third in the case of a fail operational system. At the same time the ILS glideslope and localiser channels become the armed pitch and roll modes.
The radio altimeter becomes effective at, typically, 2500 ft agl and provides all height measurements for the automatic flight control system from then until touchdown. At 1500 ft radio altitude, provided that the localiser and glideslope beams have been captured, the off-line autopilots engage and LAND 2 or LAND 3 is displayed on the autoland status annunciation, depending on the number of engaged systems. The aircraft continues to be flown by one autopilot, with the remainder performing a comparative function, overseen by the monitoring system. If these sequences have been satisfactorily completed, FLARE mode becomes armed and the glideslope and localiser beams become the engaged pitch and roll command modes, maintaining the aircraft on the glidepath centre line.
When the aircraft has descended to 330 ft radio altitude, the AFCS com- mands a nose-up trim adjustment, with pitch control being maintained through the elevators. When the main landing gear is 45 ft above ground level, as measured by the radio altimeter and adjusted to take account of the height difference between the radio altimeter transceiver and the main gear, FLARE mode engages and provides pitch commands. Roll commands are still from the localiser, to keep the aircraft on the centre line of the glidepath. The aircraft now follows a 2 ft per second descent path, rather than the glideslope beam, and the autothrottle system begins retarding the thrust levers to control airspeed for the touchdown.
Just prior to touchdown, at about 5 ft gear altitude, flare mode disengages and touchdown and roll-out modes engage. At approximately 1 ft gear altitude the AFCS commands a decrease in pitch attitude to 28 nose-up and, at touchdown, the elevators are adjusted to lower the nose and bring the nose wheels into contact with the runway. Selection of reverse thrust by the pilot disengages the autothrottle system, but the AFCS remains in control of the roll-out until disengaged by the flight crew.