WILJAM FLIGHT TRAINING

Chapter 6.3
Automatic Landing System
Introduction
If the weather is poor at a particular destination, it is still possible to land there, and not divert to
another destination, saving the expense of transporting passengers to their original destination
by other means, by using an Automatic Landing System. Any diversion also means that the
aeroplane will be out of position, and most probably would have to be flown to its original
destination with no fare paying passengers.
For an aeroplane to be certified with an automatic landing capability it must comply with the
minimum requirements laid down in JAR-AWO (ALL WEATHER OPERATIONS).
Basic Requirements for an Automatic Landing System
The basic requirements for an Automatic Landing System are that:

The safety achieved by an automatic landing must not be less than a manual
landing, and the risk of a fatal accident should be better than 1 x 10-7.

The flight crew must be able to adequately monitor the landing phase, so that if a
critical malfunction occurs, the autopilot can be manually disengaged, and manual
control of the aeroplane taken at any time, with the minimum skill required to keep
the aeroplane under control.

The aerodrome must have the required and suitably calibrated radio aids.

It is improbable that the landing performance will be outside the following limits, as
shown in the following diagram.

a. Touchdown must occur between 60m 900m after the threshold.

b. The outboard landing gear must be no more than 21 m from the runway
centre line assuming a runway width of 45 m.
Automatic Landing System Terminology
In order for an aeroplane to carry out a fully automatic approach and landing it is necessary for
the aeroplane to be fitted with two or more autopilots, and an Autothrottle system. The
utilisation of multiple systems ensures that it is unlikely that in the event of a single major
component failure in the autopilot system, it will not cause the aeroplane to deviate away from

6-3-1

WILJAM FLIGHT TRAINING

its approach path. The following terminology is associated with flight failures of an automatic
landing system:Fail-Operational. An automatic landing system is Fail-Operational if, in the event of a
failure below the alert height, during the approach, flare and landing flight phase, the
landing can still be completed by the remaining part of the automatic system. In the
event of a failure, the automatic landing system will be downgraded to a Fail-Passive
system. A Fail-Operational system is alternatively known as a Fail-Active system.
Fail-Passive. An automatic landing system is fail-passive if, in event of a failure, there
is no significant out-of-trim condition or deviation of flight path or attitude but the landing
cannot be completed automatically. A Fail-Passive system is alternatively known as a
Fail Soft system.
Dual-Dual. This term is used by some manufacturers to define a twin Fail
Operational control system, which have two passive monitoring systems. This type of
system is not the same as a Duplex system, since the control systems may or may not
be active simultaneously. In the event of a monitor detecting a failure in its associated
system, the second system with its respective monitor will be automatically switched on.
Alert Height. The alert height is a specified radio height, based on the characteristics
of the aeroplane and its Fail Operational Landing System. In operational use, if a
failure occurs above the alert height in one of the required redundant operational
systems in the aeroplane, (including, where appropriate, ground roll guidance and the
reversionary mode in a Hybrid System) the approach would be discontinued, and a
Go-Around (GA) executed, unless reversion to a higher decision height is possible. If
a failure in one of the required redundant operational systems occurred below the alert
height, it would be ignored and the approach continued.
Decision Height. This is the wheel height above the runway elevation by which a GA
must be initiated unless adequate visual reference has been established, and the
aeroplane position and approach path have been assessed as satisfactory to continue
the approach and landing safely.
Automatic Landing System Equipment Requirements
The following list of systems and equipment is required in aeroplanes with automatic landing
systems, in order to achieve the following decision heights:Decision Height 199-100ft
1. Autopilot with an ILS coupling mode. (Note: A flight director system with an
ILS coupling mode may be approved for use following failure or disconnect
of the autopilot)
2. Autothrottle (unless it can be shown speed control does not add
excessively to the crew workload).
3. Radio altimeter.
4. Excess ILS deviation warnings.

6-3-2

WILJAM FLIGHT TRAINING

Decision Height 99-50ft
1. As for decision height 199-100ft.
2. Autopilot with autoland mode.
Decision Height Below 50ft
1. As for decision height 199-100ft
2. (a) Autopilot with a fail-operational autoland mode and an automatic missed
approach mode.
OR
(b) Autopilot with automatic landing and missed approach modes and a
landing guidance display.
No Decision Height
1. As for decision height below 50ft.
2.

(a) Autopilot with a fail-operational ground roll mode.

OR
(b) Fail operational head-up ground roll guidance display.
OR
(c) Autopilot with ground roll mode and a head up ground roll guidance
display.

3. Anti-skid braking system.

Automatic Approach, Flare and Landing Sequence
The following diagram shows the stages involved during the automatic approach, flare and
landing phases of flight of an aeroplane fitted with a triple channel autopilot, such as that fitted
to a Boeing 757.

6-3-3

WILJAM FLIGHT TRAINING

Depending on the number of channels engaged the system will perform an automatic landing
with a Land 2 or Land 3 status, which is displayed on the EADI.
Land 2 signifies 2 autopilot channels engaged giving the system a Fail Passive
capability.
Land 3 signifies 3 autopilot channels engaged giving the system a Fail Operational
capability.
During the cruise and approach to an airport a single autopilot is normally engaged and
controlling the aeroplane along the designated route. As the aeroplane approaches the airport
the flight crew manually select the other autopilots, and when the Approach Mode (APP) is
selected on the AFCS control panel, the localiser/glide slope, together with the two remaining
autopilots will be armed. As the aeroplane passes through 1500 ft radio altitude, with the
localiser and glide slope already captured, the two off line autopilots will be automatically
engaged. This will be indicated to the flight crew by a LAND 3 status, and the aeroplane will
continue to fly down the glide slope.
Note:
If a single failure occurs between 1500-200ft radio altitude, the system will
downgrade itself to a Fail-Passive system, and a LAND 2 status will be annunciated.
At a radio altitude of 330ft the aeroplane will be trimmed nose up by an automatic adjustment of
the variable incidence tailplane. As the aeroplane passes through the alert height (normally
200ft radio altitude) the reversion to LAND 2 due to a fault will be inhibited until the aeroplane
is below 40 knots, during the roll out.

6-3-4

WILJAM FLIGHT TRAINING

When the aeroplane is 45ft above the ground the flare mode will be automatically engaged and
the aeroplane rate of descent will be progressively reduced to achieve a rate of 2 ft. per second
on touchdown. At the same time the Autothrottle will also reduce the amount of available
engine thrust, in order to maintain the flare path. At 5ft gear altitude the flare will be disengaged
and there will be a transition to touchdown, and the subsequent roll out mode. The Land status
will remain engaged until de-selected by the flight crew.
Importantly these systems are designed to carry out automatic landings under all visibility
conditions, and must have a reliability factor better than 1x10-7.
Weather Minima
In low visibility operations, the weather limits for landing are given in terms of the following:
Runway visual range (RVR). This is an instrumentally derived value that represents
the range at which high-intensity lights can be seen in the direction of landing along the
runway. These readings are transmitted to the aeroplane by ATC, and provide the flight
crew with the visibility conditions, which currently exist at the airport.
Decision height. This is the wheel height above the runway threshold by which a
Go-Around (GA) must be initiated, unless adequate visual reference has been
established, and the position and approach path of the aeroplane have been visually
assessed as satisfactory to safely continue the approach or landing.
Minimum values of these two quantities, which are referred to as `Weather Minima', are
specified by The National Licensing Authorities, for various types of aeroplanes, and also for
various airports.
ICAO Categorisation for Low Visibility Landing Capabilities
This system is based on the principle that the probability of having an adequate short visual
reference, for the range of permitted decision heights, should be as high as possible.
Category 1: Operation down to a minima of 200 ft decision height, and a RVR of 800
m, with a high probability of approach success.
Category 2: Operation down to a minima below 200 ft decision height and RVR of 800
m, and to as low as 100 ft decision height and RVR of 400 m, with a high probability of
approach success.
Category 3A: Operation down to, and along the surface of the runway, with external
visual reference during the final phase of the landing down to a RVR minima of 200 m.
Category 3B: Operation to, and along the surface of the runway and taxiways with
visibility sufficient only for visual taxiing comparable to a RVR value in the order of 50
m.

6-3-5

WILJAM FLIGHT TRAINING

Category 3C: Operation to, and along the surface of the runway and taxiways without
external visual reference.
These categories also serve as an indication of the stages through which automatic approach
and automatic landing development progresses, and thus designates the capabilities of an
individual AFCS.
The capabilities of the ground guidance equipment available at a particular airport are also
designated, and are as listed below.

ILS localiser and glide path.

Approach lighting.

Runway and taxiway lighting.

In connection with automatic landing systems, the term `All Weather Operations' is frequently
used. This term, which is frequently taken to mean that there are no weather conditions that can
prevent an aeroplane from taking-off and landing successfully, is not strictly correct, eg. an
aeroplane cannot perform a landing task in wind conditions in excess of those for which it has
been certificated, or on a runway which, because of contamination by water, slush or ice, is not
fit for such an operation.
The Fundamental Landing Requirement
During an automatic landing an aeroplane should be controlled in such a way that:

Its wheels make contact with the ground comfortably within the paved surface of the
runway and that the landing point is not too far down the runway.

It lands at a very low vertical velocity in order to avoid collapse of the landing gear.

The speed at touchdown should be sufficiently low to allow the aeroplane to be

brought to a halt within the remaining length of the runway.

To facilitate the above the aeroplanes:

Final rate of descent should be no greater than 1 to 2 feet per second.

Airspeed should be reduced from 1.3Vs during the approach to 1.15Vs, by a

progressive reduction of engine thrust during the landing flare.

Wings should be levelled prior to the actual landing, and any drift `Kicked-Off'
before touchdown.

To achieve all of the above, requires that the aeroplane be controlled about all three axes
simultaneously.
Any such system, as well as being capable of achieving at least the targets listed above, must
also be designed with the following aims:

6-3-6

WILJAM FLIGHT TRAINING

Achieving the highest integrity and reliability of systems, bearing in mind that they
need to be entrusted with very considerable authority over the controls of an
aeroplane, including the throttles, and in the presence of the ground.

The provision of adequate monitoring information on the progress of the approach

and landing manoeuvre, and which will enable the flight crew to take over, under
the most critical conditions of a system malfunction in the presence of the ground.

The substitution of the flight crews direct vision with an automatic externally
referenced guidance system, having an integrity and reliability of the same high
order as that demanded of the `on board' system.

System Reliability and Integrity

Devices designed to limit the authority of automatic control systems in the event of `runaway'
conditions that may result from malfunctions, may be incorporated in more conventional control
systems. These are however normally only effective for the intended purpose down to any
specified `break-off' height, ie. the approach height at which a control system is disengaged,
but these systems do not satisfy the requirements for systems designed for autoland.
The setting of safety devices is dictated by the conflicting requirements listed below:

They must limit the effect of a `runaway' such that a safe recovery can be effected
by the flight crew;

They must allow sufficient authority to the control system so that the required flight
path can be followed accurately in the presence of disturbances.

A further factor limiting the application of safety devices (in the manner of conventional control
systems) is their inability to protect against passive failures. While not producing flight path
changes directly, these failures would nevertheless mean that the predetermined and accurate
flight manoeuvre of automatic landing, could not be maintained, and so could set up an equally
dangerous situation.
It therefore follows, that to achieve the objective of automatic landing, the operation of an AFCS
must be of such a nature that it will:

Not disturb the flight path as a result of an active malfunction.

Have adequate authority for sufficiently accurate control along the required flight
path.

Warn of a passive failure.

Not fail to complete the intended flight manoeuvre following an active or a passive
failure.

In order to resolve these problems the concept of `system redundancy' is applied. ie. the use
of multiple systems, operating in such a manner that a single failure within a system will have an
insignificant effect on the aeroplane's performance during the approach and landing operation.

The autothrottle will remain in control of the engines until reverse thrust is
demanded.

6-3-7

WILJAM FLIGHT TRAINING

The AFCS will remain in control of the aeroplane until the crew disengages it.

At any time from 2000 feet down to the decision height, the flight crew can elect to abort the
approach, by pressing the TOGA switch on the throttle, which will cause the throttles to advance
to a pre-set reduced thrust Go-Around value. A second press of the TOGA switch will
command the throttles to advance the engines to full power. The Go-Around phase will then
interact with the AFCS, and will cause a GA annunciation on the ADI. The pitch channel will
generate a pitch-up command, and the aeroplane will be placed in the correct climb attitude.

6-3-8