In aviation, autoland describes a system that fully automates the landing procedure of an

aircraft's flight, with the flight crew only supervising the process. Such systems enable
aircraft to land in weather conditions that would otherwise be dangerous or impossible to
operate in.

Contents
 [hide] 

 1 Description
 2 History
o 2.1 Background
o 2.2 The development of autoland
o 2.3 Autoland for civil aviation
 3 Autoland systems
 4 Accidents
 5 See also
 6 References
 7 External links

Description[edit]
Autoland systems were designed to make landing possible in visibility too poor to permit any
form of visual landing, although they can be used at any level of visibility. They are usually
used when visibility is less than 600 meters RVR and/or in adverse weather conditions,
although limitations do apply for most aircraft—for example, for a Boeing 747-400 the
limitations are a maximum headwind of 25 kts, a maximum tailwind of 10 kts, a maximum
crosswind component of 25 kts, and a maximum crosswind with one engine inoperative of
five knots. They may also include automatic braking to a full stop once the aircraft is on the
ground, in conjunction with the autobrake system, and sometimes auto deployment of
spoilers and thrust reversers.

Autoland may be used for any suitably approved Instrument Landing System (ILS) or
Microwave Landing System (MLS) approach, and is sometimes used to maintain currency of
the aircraft and crew, as well as for its main purpose of assisting an aircraft landing in low
visibility and/or bad weather.

Autoland requires the use of a radar altimeter to determine the aircraft's height above the
ground very precisely so as to initiate the landing flare at the correct height (usually about 50
feet (15 m)). The localizer signal of the ILS may be used for lateral control even after
touchdown until the pilot disengages the autopilot. For safety reasons, once autoland is
engaged and the ILS signals have been acquired by the autoland system, it will proceed to
landing without further intervention, and can be disengaged only by completely
disconnecting the autopilot (this prevents accidental disengagement of the autoland system at
a critical moment). At least two and often three independent autopilot systems work in
concert to carry out autoland, thus providing redundant protection against failures. Most
autoland systems can operate with a single autopilot in an emergency, but they are only
certified when multiple autopilots are available.
The autoland system's response rate to external stimuli work very well in conditions of
reduced visibility and relatively calm or steady winds, but the purposefully limited response
rate means they are not generally smooth in their responses to varying wind shear or gusting
wind conditions – i.e. not able to compensate in all dimensions rapidly enough – to safely
permit their use.

The first aircraft to be certified to CAT III standards, on 28 December 1968,[1] was the Sud
Aviation Caravelle, followed by the Hawker-Siddeley HS.121 Trident in May 1972 (CAT
IIIA) and to CAT IIIB during 1975. The Trident had been certified to CAT II on 7 February
1968.

Autoland capability has seen the most rapid adoption in areas and on aircraft that must
frequently operate in very poor visibility. Airports troubled by fog on a regular basis are
prime candidates for Category III approaches, and including autoland capability on jet
airliners helps reduce the likelihood that they will be forced to divert by bad weather.

Autoland is highly accurate. In his 1959 paper [2] John Charnley, then Superintendent of the
UK Royal Aircraft Establishment's (RAE) Blind Landing Experimental Unit (BLEU),
concluded a discussion of statistical results by saying that "It is fair to claim, therefore, that
not only will the automatic system land the aircraft when the weather prevents the human
pilot, it also performs the operation much more precisely".

Traditionally autoland systems have been very expensive, and have been rare on small
aircraft. However, as display technology has developed the addition of a Head Up Display
(HUD) allows for a trained pilot to manually fly the aircraft using guidance cues from the
flight guidance system. This significantly reduces the cost of operating in very low visibility,
and allows aircraft which are not equipped for automatic landings to make a manual landing
safely at lower levels of look ahead visibility or runway visual range (RVR). Alaska Airlines
was the first airline in the world to manually land a passenger-carrying jet (Boeing 737) in
FAA Category III weather (dense fog) made possible with the Head-Up Guidance System [3]
[4]

History[edit]
See also: Blind Landing Experimental Unit

Background[edit]

Commercial aviation autoland was initially developed in Great Britain, as a result of the
frequent occurrence of very low visibility conditions in winter in North-west Europe. These
occur particularly when anticyclones are in place over central Europe in
November/December/January when temperatures are low, and radiation fog forms easily in
relatively stable air. The severity of this type of fog was exacerbated in the late 1940s and
1950s by the prevalence of carbon and other smoke particles in the air from coal burning
heating and power generation. Cities particularly affected included the main [UK] centres,
and their airports such as London Heathrow, Gatwick, Manchester, Birmingham and
Glasgow, as well as European cities such as Amsterdam, Brussels, Paris, Zurich and Milan.
Visibility at these times could become as low as a few feet (hence the "London fogs" of
movie fame) and when combined with the soot created lethal long-persistence smog: these
conditions led to the passing of the UK's "Clean Air Act" which banned the burning of
smoke-producing fuel.

Post 1945, the British government had established two state-owned airline corporations –
British European Airways (BEA) and British Overseas Airways Corporation (BOAC), which
were subsequently to be merged into today's British Airways. BEA's route network focused
on airports in the UK and Europe, and hence its services were particularly prone to disruption
by these particular conditions.

During the immediate post-war period, BEA suffered a number of accidents during approach
and landing in poor visibility, which caused it to focus on the problems of how pilots could
land safely in such conditions. A major breakthrough came with the recognition that in such
low visibility the very limited visual information available (lights and so on) was
extraordinarily easy to misinterpret, especially when the requirement to assess it was
combined with a requirement to simultaneously fly the aircraft on instruments. This led to the
development of what is now widely understood as the "monitored approach" procedure
whereby one pilot is assigned the task of accurate instrument flying while the other assesses
the visual cues available at decision height, taking control to execute the landing once
satisfied that the aircraft is in fact in the correct place and on a safe trajectory for a landing.
The result was a major improvement in the safety of operations in low visibility, and as the
concept clearly incorporates vast elements of what is now known as Crew Resource
Management (although predating this phrase by some three decades) it was expanded to
encompass a far broader spectrum of operations than just low visibility.

However, associated with this "human factors" approach was a recognition that improved
autopilots could play a major part in low visibility landings. The components of all landings
are the same, involving navigation from a point at altitude "en route" to a point where the
wheels are on the desired runway. This navigation is accomplished using information from
either external, physical, visual cues or from synthetic cues such as flight instruments. At all
times there must be sufficient total information to ensure that the aircraft's position and
trajectory (vertical and horizontal) are correct. The problem with low visibility operations is
that the visual cues may be reduced to effectively zero, and hence there is an increased
reliance on "synthetic" information. The dilemma faced by BEA was to find a way to operate
without cues, because this situation occurred on its network with far greater frequency than
on that of any other airline. It was particularly prevalent at its home base – London – which
could effectively be closed for days at a time.

The development of autoland[edit]

The UK government's aviation research facilities including the Blind Landing Experimental
Unit (BLEU) set up during 1945/46 at RAF Martlesham Heath and RAF Woodbridge to
research all the relevant factors. BEA's flight technical personnel were heavily involved in
BLEU's activities in the development of Autoland for its Trident fleet from the late 1950s.
The work included analysis of fog structures, human perception, instrument design, and
lighting cues amongst many others. After further accidents, this work also led to the
development of aircraft operating minima in the form we know them today. In particular, it
led to the requirement that a minimum visibility must be reported as available before the
aircraft may commence an approach – a concept that had not existed previously. The basic
concept of a "target level of safety" (10-7) and of the analysis of "fault trees" to determine
probability of failure events stemmed from about this period.
The basic concept of autoland flows from the fact that an autopilot could be set up to track an
artificial signal such as an Instrument Landing System (ILS) beam more accurately than a
human pilot could – not least because of the inadequacies of the electro-mechanical flight
instruments of the time. If the ILS beam could be tracked to a lower height then clearly the
aircraft would be nearer to the runway when it reached the limit of ILS usability, and nearer
to the runway less visibility would be required to see sufficient cues to confirm the aircraft
position and trajectory. With an angular signal system such as ILS, as altitude decreases all
tolerances must be decreased – in both the aircraft system and the input signal – to maintain
the required degree of safety. This is because certain other factors – physical and
physiological laws which govern for example the pilot's ability to make the aircraft respond –
remain constant. For example, at 300 feet above the runway on a standard 3 degree approach
the aircraft will be 6000 feet from the touchdown point, and at 100 feet it will be 2000 feet
out. If a small course correction needs 10 seconds to be effected at 180kts it will take 3000 ft.
It will be possible if initiated at 300 feet of height, but not at 100 feet. Consequently only a
smaller course correction can be tolerated at the lower height, and the system needs to be
more accurate.

This imposes a requirement for the ground based guidance element to conform to specific
standards, as well as the airborne elements. Thus, while an aircraft may be equipped with an
autoland system, it will be totally unusable without the appropriate ground environment.
Similarly, it requires a crew trained in all aspects of the operation to recognise potential
failures in both airborne and ground equipment, and to react appropriately, to be able to use
the system in the circumstances from which it is intended. Consequently, the low visibility
operations categories (Cat I, Cat II and Cat III) apply to all 3 elements in the landing – the
aircraft equipment, the ground environment, and the crew. The result of all this is to create a
spectrum of low visibility equipment, in which an aircraft's "autoland" autopilot is just one
component.

The development of these systems proceeded by recognising that although the ILS would be
the source of the guidance, the ILS itself contains lateral and vertical elements that have
rather different characteristics. In particular, the vertical element (glideslope) originates from
the projected touchdown point of the approach, i.e. typically 1000 ft from the beginning of
the runway, while the lateral element (localiser) originates from beyond the far end. The
transmitted glideslope therefore becomes irrelevant soon after the aircraft has reached the
runway threshold, and in fact the aircraft has of course to enter its landing mode and reduce
its vertical velocity quite a long time before it passes the glideslope transmitter. The
inaccuracies in the basic ILS could be seen in that it was suitable for use down to 200 ft. only
(Cat I), and similarly no autopilot was suitable for or approved for use below this height.

The lateral guidance from the ILS localiser would however be usable right to the end of the
landing roll, and hence is used to feed the rudder channel of the autopilot after touchdown. As
aircraft approached the transmitter its speed is obviously reducing and rudder effectiveness
diminishes, compensating to some extent for the increased sensitivity of the transmitted
signal. More significantly however it means the safety of the aircraft is still dependent on the
ILS during rollout. Furthermore, as it taxis off the runway and down any parallel taxiway, it
itself acts a reflector and can interfere with the localiser signal. This means that it can affect
the safety of any following aircraft still using the localiser. As a result, such aircraft cannot be
allowed to rely on that signal until the first aircraft is well clear of the runway and the "Cat. 3
protected area".
The result is that when these low visibility operations are taking place, operations on the
ground affect operations in the air much more than in good visibility, when pilots can see
what is happening. At very busy airports, this results in restrictions in movement which can
in turn severely impact the airport's capacity. In short, very low visibility operations such as
autoland can only be conducted when aircraft, crews, ground equipment and air and ground
traffic control all comply with more stringent requirements than normal.

The first "commercial development" automatic landings (as opposed to pure experimentation)
were achieved through realising that the vertical and lateral paths had different "rules".
Although the localiser signal would be present throughout the landing, the glide slope had to
be disregarded before touchdown in any event. It was recognised that if the aircraft had
arrived at Decision Height (200 ft) on a correct, stable approach path – a prerequisite for a
safe landing – it would have momentum along that path. Consequently, the autoland system
could discard the glideslope information when it became unreliable (i.e. at 200 ft), and use of
pitch information derived from the last several seconds of flight would ensure to the required
degree of reliability that the descent rate (and hence adherence to the correct profile) would
remain constant. This "ballistic" phase would end at the height when it became necessary to
increase pitch and reduce power to enter the landing flare. The pitch change occurs over the
runway in the 1000 horizontal feet between the threshold and the glide slope antenna, and so
can be accurately triggered by radio altimeter.

Autoland was first developed in BLEU and RAF aircraft such as the English Electric
Canberra, Vickers Varsity and Avro Vulcan, and later for BEA's Trident fleet, which entered
service in the early 1960s. The Trident was a 3 engined jet built by de Havilland with a
similar configuration to the Boeing 727, and was extremely sophisticated for its time. BEA
had specified a "zero visibility" capability for it to deal with the problems of its fog-prone
network. It had an autopilot designed to provide the necessary redundancy to tolerate failures
during autoland, and it was this design which had "triple redundancy.

This autopilot used three simultaneous processing channels each giving a physical output.
The fail-safe element was provided by a "voting" procedure using torque switches, whereby it
was accepted that in the event that one channel differed from the other two, the probability of
two similar simultaneous failures could be discounted and the two channels in agreement
would "out-vote" and disconnect the third channel. However, this triple-voting system is by
no means the only way to achieve adequate redundancy and reliability, and in fact soon after
BEA and de Havilland had decided to go down that route, a parallel trial was set up using a
"dual-dual" concept, chosen by BOAC and Vickers for the VC10 4-engined long range
aircraft. This concept was later used on the Concorde. Some BAC 1-11 aircraft used by BEA
also had a similar system.

Autoland for civil aviation[edit]

The earliest experimental autopilot-controlled landings in commercial service were not in fact
full auto landings but were termed "auto-flare". In this mode the pilot controlled the roll and
yaw axes manually while the autopilot controlled the "flare" or pitch. These were often done
in passenger service as part of the development program. The Trident's autopilot had separate
engagement switches for the pitch and roll components, and although the normal autopilot
disengagement was by means of a conventional control yoke thumb-button, it was also
possible to disengage the roll channel while leaving the pitch channel engaged. In these
operations the pilot had acquired full visual reference, normally well above decision height,
but instead of fully disengaging the autopilot with the thumb-button, called for the second
officer to latch off the roll channel only. He then controlled the lateral flight path manually
while monitoring the autopilot's continued control of the vertical flight path – ready to
completely disengage it at the first sign of any deviation. While this sounds as if it may add a
risk element in practice it is of course no different in principle to a training pilot monitoring a
trainee's handling during on-line training or qualification.

Having proven the reliability and accuracy of the autopilot's ability to flare the aircraft safely,
the next elements were to add in similar control of the thrust. This was similarly done by a
radio altimeter signal which simply drove the autothrottle servos to a flight idle setting. As
the accuracy and reliability of the ground based ILS localiser was increased on a step by step
basis, it was permissible to leave the roll channel engaged longer and longer, until in fact the
aircraft had ceased to be airborne, and a fully automatic landing had in fact been completed.
The first such landing in a BEA Trident was achieved at RAE Bedford (by then home of
BLEU) in March 1964. The first on a commercial flight with passengers aboard was achieved
on flight BE 343 on 10 June 1965, with a Trident 1 G-ARPR, from Paris to Heathrow with
Captains Eric Poole and Frank Ormonroyd.

Subsequently autoland systems became available on a number of aircraft types but the
primary customers were those mainly European airlines whose networks were severely
affected by radiation fog. Early Autoland systems needed a relatively stable air mass and
could not operate in conditions of turbulence and in particular gusty crosswinds. In North
America it was generally the case that reduced but not zero visibility was often associated
with these conditions, and if the visibility really became almost zero in, for example, blowing
snow or other precipitation then operations would be impossible for other reasons. As a result
neither airlines nor airports placed a high priority on operations in the lowest visibility. The
provision of the necessary ground equipment (ILS) and associated systems for Category 3
operations was almost non existent and the major manufacturers did not regard it as a basic
necessity for new aircraft. In general during the 1970s and 1980s it was available if a
customer wanted it, but at such a high price (due to being a reduced production run item) that
few airlines could see a cost justification for it.

(This led to the absurd situation for British Airways that as the launch customer for the
Boeing 757 to replace the Trident, the brand-new "advanced" aircraft had inferior all weather
operations capability compared to the fleet being broken up for scrap. An indication of this
philosophical divide is the comment from a senior Boeing Vice President that he could not
understand why British Airways were so concerned about the Category 3 certification, as
there were only at that time two or three suitable runways in North America on which it could
be fully used. It was pointed out that British Airways had some 12 such runways on its
domestic network alone, four of them at its main base at Heathrow.)

In the 1980s and 1990s there was, however, increasing pressure globally from customer
airlines for at least some improvements in low visibility operations; both for flight regularity
and from safety considerations. At the same time it became evident that the requirement for a
true "zero visibility" operation (as originally envisaged in the ICAO Category definitions)
had diminished, as "clean air" laws had reduced the adverse effect of smoke adding to
radiation fog in the worst affected areas. Improved avionics meant that the technology
became cheaper to implement, and manufacturers raised the standard of the "basic" autopilot
accuracy and reliability. The result was that on the whole the larger new airliners were now
able to absorb the costs of at least Category 2 autoland systems into their basic configuration.
Simultaneously pilot organizations globally were advocating the use of Head Up Display
systems primarily from a safety viewpoint. Many operators in non-sophisticated
environments without many ILS equipped runways were also looking for improvements. The
net effect was pressure within the industry to find alternative ways to achieve low visibility
operations, such as a "Hybrid" system which used a relatively low reliability autoland system
monitored by the pilots via a HUD. Alaska Airlines was a leader in this approach and
undertook a lot of development work with Flight Dynamics and Boeing in this respect.

However a major problem with this approach was that European authorities were very
reluctant to certificate such schemes as they undermined the well proven concepts of "pure"
autoland systems. This impasse was broken when British Airways became involved as a
potential customer for Bombardier's Regional Jet, which could not accommodate a full Cat 3
autoland system, but would be required to operate in those conditions. By working with
Alaska Airlines and Boeing, British Airways technical pilots were able to demonstrate that a
"Hybrid" concept was feasible, and although British Airways never eventually bought the
Regional Jet, this was the breakthrough needed for international approval for such systems
which meant that they could reach a global market.

The wheel turned full circle when in December 2006 London Heathrow was affected for a
long period by dense fog. This airport was operating at maximum capacity in good
conditions, and the imposition of low visibility procedures required to protect the localiser
signal for autoland systems meant a major reduction in capacity from approximately 60 to 30
landings per hour. Since most airlines operating into Heathrow already had autoland-
equipped aircraft, and thus expected to operate as normal, massive delays occurred. The
worst affected airline was of course British Airways, as the largest operator at the airport.

Autoland systems[edit]
This section needs additional citations for verification. Please help improve this
article by adding citations to reliable sources. Unsourced material may be challenged
and removed. (August 2011)

A typical autoland system consists of an ILS (integrated glideslope receiver, localizer

receiver, and perhaps GPS receiver as well) radio to receive the localizer and glideslope
signals. The output of this radio will be a "deviation" from center which is provided to the
flight control computer; this computer which controls the aircraft control surfaces to maintain
the aircraft centered on the localizer and glideslope. The flight control computer also controls
the aircraft throttles to maintain the appropriate approach speed. At the appropriate height
above the ground (as indicated by the radio altimeter) the flight control computer will retard
the throttles and initiate a pitch-up maneuver. The purpose of this "flare" is to reduce the
energy of the aircraft such that it "stops flying" and settles onto the runway.

For CAT IIIc, the flight control computer will continue to accept deviations from the
localizer and use the rudder to maintain the aircraft on the localizer (which is aligned with the
runway centerline.) On landing the spoilers will deploy (these are surfaces on the top of the
wing towards the trailing edge) which causes airflow over the wing to become turbulent,
destroying lift. At the same time the autobrake system will apply the brakes and the thrust
reversers will activate to maintain a deceleration profile. The anti-skid system will modulate
brake pressure to keep all wheels turning. As the speed decreases, the rudder will lose
effectiveness and the pilot will need to control the direction of the airplane using nose wheel
steering, a system which typically is not connected to the flight control computer.

From an avionics safety perspective, a CAT IIIc landing is the "worst-case scenario" for
safety analysis because a failure of the automatic systems from flare through the roll-out
could easily result in a "hard over" (where a control surface deflects fully in one direction.)
This would happen so fast that the flight crew may not effectively respond. For this reason
Autoland systems are designed to incorporate a high degree of redundancy so that a single
failure of any part of the system can be tolerated (fail active) and a second failure can be
detected – at which point the autoland system will turn itself off (uncouple, fail passive). One
way of accomplishing this is to have "three of everything." Three ILS receivers, three radio
altimeters, three flight control computers, and three ways of controlling the flight surfaces.
The three flight control computers all work in parallel and are in constant cross
communications, comparing their inputs (ILS receivers and radio altimeters) with those of the
other two flight control computers. If there is a difference in inputs, then a computer can
"vote out" the deviant input and will notify the other computers that "RA1 is faulty." If the
outputs don't match, a computer can declare itself as faulty and, if possible, take itself off
line.

When the pilot "arms" the system (prior to capture of either the localizer or glideslope) the
flight control computers perform an extensive series of Built In Tests (BIT). For a CAT III
landing, all the sensors and all the flight computers must be "in good health" before the pilot
receives an AUTOLAND ARM (These are generic indications and will vary depending on
equipment supplier and aircraft manufacturer) indication. If part of the system is in error, then
an indication such as "APPROACH ONLY" would be presented to inform the flight crew
that a CAT III landing is not possible. If the system is properly in the ARM mode, when the
ILS receiver detects the localizer, then the autoland system mode will change to
'LOCALIZER CAPTURE' and the flight control computer will turn the aircraft into the
localizer and fly along the localizer. A typical approach will have the aircraft come in "below
the glideslope" (vertical guidance) so the airplane will fly along the localizer (aligned to the
runway centerline) until the glideslope is detected at which point the autoland mode will
change to CAT III and the aircraft will be flown by the flight control computer along the
localizer and glideslope beams. The antennas for these systems are not at the runway touch
down point however, with the localizer being some distance beyond the runway. However at
a predefined distance above the ground the aircraft will initiate the flare maneuver, maintain
the same heading, and settle onto the runway within the designated touch down zone.

If the autoland system loses redundancy prior to the decision height, then an AUTOLAND
FAULT will be displayed to the flight crew at which point the crew can elect to continue as a
CAT II approach or if this is not possible because of weather conditions, then the crew would
need to initiate a go-around and proceed to an alternative airport.

If a single failure occurs below decision height AUTOLAND FAULT will be displayed,
however at that point the aircraft is committed to landing and the autoland system will remain
engaged, controlling the aircraft on only two systems until the pilot completes the rollout and
brings the aircraft to a full stop on the runway or turns off the runway onto a taxiway. This is
termed "fail active." However in this state the autoland system is "one fault away" from
disengaging so the AUTOLAND FAULT indication should inform the flight crew to monitor
the system behavior very careful and be ready to take control immediately. The system is still
fail active and is still performing all necessary cross checks so that if one of the flight control
computers decides that the right thing to do is order a full deflection of a control surface, the
other computer will detect that there is a difference in the commands and this will take both
computers off line (fail passive) at which time the flight crew must immediately take control
of the aircraft as the automatic systems have done the safe thing by taking themselves off
line.

During system design, the predicted reliability numbers for the individual equipment which
makes up the entire autoland system (sensors, computers, controls, and so forth) are
combined and an overall probability of failure is calculated. As the "threat" exists primarily
during the flare through roll-out, this "exposure time" is used and the overall failure
probability must be less than one in a million.[5]

Accidents[edit]
On February 25, 2009, a Turkish Airlines Boeing 737-800 (Turkish Airlines Flight 1951)
crashed about 1500m short of the runway at Amsterdam Schiphol Airport. The Dutch Safety
Board published preliminary findings only one week after the crash, suggesting the autoland
played a key role in downing the plane. According to the Flight Data Recorder, the airplane
was on a full autoland approach at a height of 1950 ft / 595 m, the left Radio Altimeter had
been misreporting a height of −8 ft. The autoland system responded accordingly and
configured the plane for touchdown, idling the engines. This made the plane lose speed and
stall. When the flight crew received stall-warnings, they were already too low and too slow to
recover. As a secondary factor, the Safety Board suggested the crew did not have a visual
ground reference because of foggy conditions.

The final investigation report was released on 6 May 2010.[6]