Autoland

Autoland is an automatic landing: the autopilot, guided by the ILS or another precision approach aid and by the radio altimeters, flies the final approach, flares, puts the aircraft on the runway and, on suitably equipped types, steers it along the centreline during the rollout. The autothrottle or autothrust closes the thrust levers in the flare. The crew's job changes from flying to monitoring and deciding: whether the system is still capable of what the approach requires, and whether to continue or go around.

Autoland is what makes the lowest landing minima possible: Category III operations, with a decision height below 100 ft or none, generally rely on an automatic landing or on head-up guidance to touchdown (see low-visibility operations). EASA certifies the equipment against CS-AWO, the certification specification for all-weather operations; the FAA's criteria for approving take-off, landing and rollout in all weather are consolidated in AC 120-118.

Coupled approaches

A coupled approach is one flown by the autopilot following the ILS. The crew arms the approach mode, APP on the Boeing mode control panel or APPR on the Airbus flight control unit, and the autopilot captures the localiser, then the glide path. Because ILS guidance is angular, the beams tighten as the runway nears; the autopilot's response is desensitised with radio altitude, and its authority reduced. EASA training texts give an example of bank limits reduced from 45° in manual modes to 30° when tracking a localiser and 15° on final approach and autoland.

A coupled approach is not necessarily an autoland. With a single autopilot on the 737 the FMA shows SINGLE CH in amber after localiser capture, and the autopilot must be disengaged, with the autothrottle, no later than the minimum use height for single autopilot operation. Boeing's FAA limitations do not let a single-channel autopilot remain engaged below 50 ft. The A320 FCOM requires the autopilot off by 80 ft for a CAT II approach ending in a manual landing.

Dual autopilot approaches

An automatic landing needs redundancy: close to the ground a malfunction must neither disturb the flight path nor leave the crew without guidance. EASA training texts give the minimum equipment as at least two independent autopilots able to follow the ILS, at least two independent radio altimeters, and an ILS ground installation of the category required. On the Boeing 737 full automatic flare and touchdown are available only with both autopilots engaged in APP mode, a dual autopilot approach or dual-channel approach, and only with two generators powering the busses. The A320 can land with one autopilot, but needs both for its fail-operational capability.

At 400 ft RA the 737 trims the stabiliser further nose-up, which helps the flare and biases the aircraft nose-up if the autopilots disengage. Once FLARE is armed, an automatic go-around is also armed, flown by both autopilots when the pilot pushes TO/GA (see autothrottle). A red AUTOLAND warning light on the 737 flashes if, below 500 ft, an autopilot disengages, a stabiliser trim warning occurs, or the ILS deviation is excessive below 200 ft. On the A320 it flashes below 200 ft if, among other conditions, the localiser deviation exceeds a quarter of a dot above 15 ft.

Fail-passive and fail-operational

Automatic landing systems are classed by what a single failure does to them. EASA training texts list four aims: an active failure must not disturb the flight path; the system must have enough authority to control the path accurately; it must warn of a passive failure; and it must allow the manoeuvre to be completed after a failure.

• A fail-passive system, also called fail-soft, causes no significant out-of-trim condition or deviation of flight path or attitude after a failure, but it cannot finish the landing. The pilot takes over and lands or goes around, so a decision height and visual reference are needed. Two autopilots are the minimum.
• A fail-operational system, also called fail-active, can still complete the approach, flare and landing after a failure below alert height. It needs three autopilot channels, or two with duplicated monitoring in each. After the failure it operates as a fail-passive system.

The alert height is a radio height, set for the aircraft type and its fail-operational system. A failure above it means a go-around, unless the approach can continue to a higher decision height with the capability remaining; below it, the landing continues. With a fail-operational system a Category III approach may have no decision height at all.

The A320 shows the capabilities in concrete figures. CAT 3 SINGLE, a fail-passive capability, allows a decision height down to 50 ft. CAT 3 DUAL, the only fail-operational one, needs both autopilots, uses an alert height of 100 ft, and allows a decision height down to 20 ft or, with no decision height, an RVR down to 75 m. Both require the autothrust. The FAA associates fail-passive systems with CAT IIIa and a decision height around 50 ft, and fail-operational systems with CAT IIIb.

LAND 2 and LAND 3 status

The crew must always know what the system can still do. On the Boeing types that display them, LAND 3 means triple redundancy of power sources, flight control computers, sensors and servos, a fail-operational capability; LAND 2 means dual redundancy, fail-passive. A single failure in LAND 2 means a manual landing; in LAND 3, the autoland continues.

Boeing aircraft with a fail-operational autoland report downgrades above alert height with advisories: NO LAND 3 when a failure has occurred but the system can still make a safe landing, and NO AUTOLAND when it can no longer land automatically. Airbus shows the capability on the FMA as CAT 1, CAT 2, CAT 3 SINGLE or CAT 3 DUAL. A downgrade sounds a triple click, and below 200 ft RA the displayed CAT 3 capability is frozen while the autopilot is in LAND, FLARE or ROLL OUT. CAT 2 and CAT 3 SINGLE are fail-passive; with only CAT 1 displayed, an automatic landing is not permitted.

Sensors downgrade the status as much as computers do. The radio altimeter supplies the height for the flare, the thrust retard and the alignment manoeuvre, and a single radio altimeter failure turns a fail-operational system fail-passive.

Flare and runway alignment

The glide path cannot guide the aircraft onto the runway: followed to the ground it would put the aircraft on at the full descent rate. In the flare the autopilot replaces glideslope tracking with radio altitude. In the 737-400 description used in EASA training texts, the flare engages at 50 ft RA and follows a path computed from the rate at which radio height is falling, reducing the sink rate from 10 to 12 ft per second to 1 to 2 ft per second at touchdown. The flight director bars retract at about 50 ft RA, and the autothrottle starts retarding at 27 ft so that the thrust reaches idle at touchdown.

In a crosswind the aircraft tracks the runway with its nose into wind. Landing with that drift angle would load the landing gear sideways, so the autopilot must perform runway alignment, also called decrab or drift kick-off. In the classic description the yaw channel measures the difference between heading and track from 1,500 ft, the align mode is armed with the flare, and below 100 ft the rudder yaws the aircraft onto the runway heading before touchdown. On the A320 the FLARE mode itself provides the yaw alignment together with the pitch flare.

Wind, glide path angle and configuration limit what each system has demonstrated:

The A320's automatic landing was also demonstrated only at aerodromes at or below 2,500 ft elevation, and its automatic rollout only on dry and wet runways, not contaminated ones.

Rollout guidance

After touchdown the task becomes staying on the centreline in fog. Rollout guidance steers in proportion to the localiser deviation. The steering can be automatic, through the rudder and nosewheel steering, or presented to the pilot on a display to follow, such as the para-visual display of some older types. On the A320 the ROLL OUT mode engages at touchdown and disengages if the aircraft's track differs from the runway track by more than 20°; the autopilots are disengaged at the end of the rollout, or at touchdown if nosewheel steering or anti-skid has failed.

Rollout capability matters for the lowest RVRs. Under the pre-2022 EU-OPS rules still used in exam questions, the lowest CAT IIIB RVR, 75 m, required a fail-operational system with fail-operational rollout and a decision height below 50 ft or none.

The localiser also steers the rollout, and vehicles or aircraft near its antennas can disturb it. Low-visibility procedures protect the ILS critical and sensitive areas; in good weather they may not be protected, which is why the FAA's AIM asks crews to advise the tower of any planned autoland whenever the weather is at or above an 800 ft ceiling and 2 miles visibility (see instrument landing system). Whatever the weather, the pilot flying keeps a hand ready to disconnect and land or go around manually if the aircraft deviates.

Library articles are written for study and exam preparation. They do not replace your aircraft's approved documentation, your operator's procedures or the regulations themselves.