Autoland
Encyclopedia
In aviation
, autoland describes a system that fully automates
the landing
phase of an aircraft
's flight, with the human crew merely supervising the process.
possible in visibility too poor to permit any form of visual landing, although they can be used at any level of visibility. They are usually used when visibility is less than 600 meters RVR
and/or in adverse weather conditions, although limitations do apply for most aircraft—for example, for a Boeing 747-400
the limitations are a maximum headwind of 25 kts, a maximum tailwind
of 10 kts, a maximum crosswind
component of 25 kts, and a maximum crosswind with one engine inoperative of five knots. They may also include automatic braking to a full stop once the aircraft is on the ground, in conjunction with the autobrake system
, and sometimes auto deployment of spoilers
and thrust reversers.
Autoland may be used for any suitably approved Instrument Landing System
(ILS) or Microwave Landing System
(MLS) approach, and is sometimes used to maintain currency of the aircraft and crew, as well as for its main purpose of assisting an aircraft landing in low visibility and/or bad weather.
Autoland requires the use of a radar altimeter
to determine the aircraft's height
above the ground very precisely so as to initiate the landing flare
at the correct height (usually about 50 feet). The localizer
signal of the ILS may be used for lateral control even after touchdown until the pilot disengages the autopilot
. For safety reasons, once autoland is engaged and the ILS signals have been acquired by the autoland system, it will proceed to landing without further intervention, and can be disengaged only by completely disconnecting the autopilot (this prevents accidental disengagement of the autoland system at a critical moment). At least two and often three independent autopilot systems work in concert to carry out autoland, thus providing redundant protection against failures. Most autoland systems can operate with a single autopilot in an emergency, but they are only certified when multiple autopilots are available.
The autoland system's response rate to external stimuli work very well in conditions of reduced visibility and relatively calm or steady winds, but the purposefully limited response rate means they are not generally smooth in their responses to varying wind shear
or gusting wind conditions - i.e. not able to compensate in all dimensions rapidly enough - to safely permit their use.
The first aircraft to be certified to CAT III standards, on 28 December 1968 , was the Sud Aviation Caravelle
, followed by the Hawker-Siddeley HS.121 Trident in May 1972 (CAT IIIA) and to CAT IIIB during 1975. The Trident had been certified to CAT II on 7 February 1968.
Autoland capability has seen the most rapid adoption in areas and on aircraft that must frequently operate in very poor visibility. Airports troubled by fog on a regular basis are prime candidates for Category III approaches, and including autoland capability on jet airliner
s helps reduce the likelihood that they will be forced to divert by bad weather.
Autoland is highly accurate. In his 1959 paper John Charnley, then Superintendent of the UK Royal Aircraft Establishment's Blind Landing Experimental Unit (BLEU), concluded a discussion of statistical results by saying that "It is fair to claim, therefore, that not only will the automatic system land the aircraft when the weather prevents the human pilot, it also performs the operation much more precisely".
Traditionally autoland systems have been very expensive, and have been rare on small aircraft. However, as display technology has developed the addition of a Head Up Display (HUD) allows for a trained pilot to manually fly the aircraft using guidance cues from the flight guidance system. This significantly reduces the cost of operating in very low visibility, and allows aircraft which are not equipped for automatic landings to make a manual landing safely at lower levels of look ahead visibility or runway visual range (RVR). Alaska Airlines
was the first airline in the world to manually land a passenger-carrying jet (Boeing 737
) in FAA
Category III weather (dense fog) made possible with the Head-Up Guidance System
, as a result of the frequent occurrence of very low visibility conditions in winter in North-west Europe. These occur particularly when anticyclone
s are in place over central Europe in November/December/January when temperatures are low, and radiation fog forms easily in relatively stable air. The severity of this type of fog was exacerbated in the late 1940s and 1950s by the prevalence of carbon and other smoke particles in the air from coal
burning heating and power generation. Cities particularly affected included the main [UK] centres, and their airports such as London Heathrow, Gatwick, Manchester
, Birmingham
and Glasgow
, as well as European cities such as Amsterdam
, Brussels
, Paris
, Zurich
and Milan
. Visibility at these times could become as low as a few feet (hence the “London fog
s” of movie fame) and when combined with the soot created lethal long-persistence smog: these conditions led to the passing of the UK’s “Clean Air Act
” which banned the burning of smoke-producing fuel.
Post 1945, the British government had established two state-owned airline corporations – British European Airways
(BEA) and British Overseas Airways Corporation
(BOAC), which were subsequently to be merged into today’s British Airways
. BEA’s route network focused on airports in the UK and Europe, and hence its services were particularly prone to disruption by these particular conditions.
During the immediate post-war period, BEA suffered a number of accidents during approach and landing in poor visibility, which caused it to focus on the problems of how pilots could land safely in such conditions. A major breakthrough came with the recognition that in such low visibility the very limited visual information available (lights and so on) was extraordinarily easy to misinterpret, especially when the requirement to assess it was combined with a requirement to simultaneously fly the aircraft on instruments. This led to the development of what is now widely understood as the “monitored approach” procedure whereby one pilot is assigned the task of accurate instrument flying while the other assesses the visual cues available at decision height, taking control to execute the landing once satisfied that the aircraft is in fact in the correct place and on a safe trajectory for a landing. The result was a major improvement in the safety of operations in low visibility, and as the concept clearly incorporates vast elements of what is now known as Crew Resource Management
(although predating this phrase by some three decades) it was expanded to encompass a far broader spectrum of operations than just low visibility.
However, associated with this “human factors” approach was a recognition that improved autopilots could play a major part in low visibility landings. The components of all landings are the same, involving navigation from a point at altitude “en route” to a point where the wheels are on the desired runway. This navigation is accomplished using information from either external, physical, visual cues or from synthetic cues such as flight instruments. At all times there must be sufficient total information to ensure that the aircraft’s position and trajectory (vertical and horizontal) are correct. The problem with low visibility operations is that the visual cues may be reduced to effectively zero, and hence there is an increased reliance on “synthetic” information. The dilemma faced by BEA was to find a way to operate without cues, because this situation occurred on its network with far greater frequency than on that of any other airline. It was particularly prevalent at its home base – London – which could effectively be closed for days at a time.
and RAF Woodbridge
to research all the relevant factors. The pioneering work by BLEU is described below. BEA’s flight technical personnel were heavily involved in BLEU's activities in the development of Autoland for its Trident fleet from the late 1950s. The work included analysis of fog structures, human perception, instrument
design, and lighting cues amongst many others. After further accidents, this work also led to the development of aircraft operating minima in the form we know them today. In particular, it led to the requirement that a minimum visibility must be reported as available before the aircraft may commence an approach – a concept that had not existed previously. The basic concept of a “target level of safety” (10-7) and of the analysis of “fault trees” to determine probability of failure events stemmed from about this period.
The basic concept of autoland flows from the fact that an autopilot could be set up to track an artificial signal such as an Instrument Landing System
(ILS) beam more accurately than a human pilot could – not least because of the inadequacies of the electro-mechanical flight instruments of the time. If the ILS beam could be tracked to a lower height then clearly the aircraft would be nearer to the runway when it reached the limit of ILS usability, and nearer to the runway less visibility would be required to see sufficient cues to confirm the aircraft position and trajectory. With an angular signal system such as ILS, as altitude decreases all tolerances must be decreased – in both the aircraft system and the input signal - to maintain the required degree of safety. This is because certain other factors – physical and physiological laws which govern for example the pilot’s ability to make the aircraft respond – remain constant. For example, at 300 feet above the runway on a standard 3 degree approach the aircraft will be 6000 feet from the touchdown point, and at 100 feet it will be 2000 feet out. If a small course correction needs 10 seconds to be effected, at 180kts it will take 3000 ft. It will be possible if initiated at 300 feet of height, but not at 100 feet. Consequently only a smaller course correction can be tolerated at the lower height, and the system needs to be more accurate.
This imposes a requirement for the GROUND based guidance element to conform to specific standards, as well as the airborne elements. Thus, while an aircraft may be equipped with an autoland system, it will be totally unusable without the appropriate ground environment. Similarly, it requires a crew trained in all aspects of the operation to recognise potential failures in both airborne and ground equipment, and to react appropriately, to be able to use the system in the circumstances from which it is intended. Consequently, the low visibility operations categories “Cat I, Cat II and Cat III) apply to all 3 elements in the landing – the aircraft equipment, the ground environment, and the crew. The result of all this is to create a spectrum of low visibility equipment, in which an aircraft’s “autoland” autopilot is just one component.
The development of these systems proceeded by recognising that although the ILS would be the source of the guidance, the ILS itself contains lateral and vertical elements that have rather different characteristics. In particular, the vertical element (glideslope) originates from the projected touchdown point of the approach, i.e. typically 1000 ft from the beginning of the runway
, while the lateral element (localiser) originates from beyond the far end. The transmitted glideslope therefore becomes irrelevant soon after the aircraft has reached the runway threshold, and in fact the aircraft has of course to enter its landing mode and reduce its vertical velocity quite a long time before it passes the glideslope transmitter. The inaccuracies in the basic ILS could be seen in that it was suitable for use down to 200 ft. only (Cat I), and similarly no autopilot was suitable for or approved for use below this height.
The lateral guidance from the ILS Localiser would however be usable right to the end of the landing roll, and hence is used to feed the rudder
channel of the autopilot after touchdown. As aircraft approached the transmitter its speed is obviously reducing and rudder effectiveness diminishes, compensating to some extent for the increased sensitivity of the transmitted signal. More significantly however it means the safety of the aircraft is still dependent on the ILS during rollout. Furthermore, as it taxis off the runway and down any parallel taxiway, it itself acts a reflector and can interfere with the localiser signal. This means that it can affect the safety of any following aircraft still using the localiser. As a result, such aircraft cannot be allowed to rely on that signal until the first aircraft is well clear of the runway and the “Cat. 3 protected area”.
The result is that when these low visibility operations are taking place, operations on the ground affect operations in the air much more than in good visibility, when pilots can see what is happening. At very busy airports, this results in restrictions in movement which can in turn severely impact the airport’s capacity. In short, very low visibility operations such as autoland can only be conducted when aircraft, crews, ground equipment and air and ground traffic control ALL comply with more stringent requirements than normal.
The first “commercial development” automatic landings (as opposed to pure experimentation) were achieved through realising that the vertical and lateral paths had different “rules”. Although the localiser signal would be present throughout the landing, the glide slope had to be disregarded before touchdown in any event. It was recognised that if the aircraft had arrived at Decision Height (200 ft) on a correct, stable approach path – a prerequisite for a safe landing – it would have momentum along that path. Consequently, the autoland system could discard the glideslope information when it became unreliable (i.e. at 200 ft), and use of pitch information derived from the last several seconds of flight would ensure to the required degree of reliability that the descent rate (and hence adherence to the correct profile) would remain constant. This “ballistic
” phase would end at the height when it became necessary to increase pitch and reduce power to enter the landing flare. The pitch change occurs over the runway in the 1000 horizontal feet between the threshold and the glide slope antenna, and so can be accurately triggered by radio altimeter.
Autoland was first developed in BLEU and RAF aircraft, and later for BEA's Trident
fleet, which entered service in the early 1960s. The Trident was a 3 engined jet
built by de Havilland
with a similar configuration to the Boeing 727, and was extremely sophisticated for its time. BEA had specified a “zero visibility” capability for it to deal with the problems of its fog-prone network. It had an autopilot designed to provide the necessary redundancy to tolerate failures during autoland, and it was this design which had “triple redundancy.
This autopilot used three simultaneous processing channels each giving a physical output. The fail-safe
element was provided by a “voting” procedure using torque switches, whereby it was accepted that in the event that one channel differed from the other two, the probability of TWO similar simultaneous failures could be discounted and the two channels in agreement would “out-vote” and disconnect the third channel. However, this triple-voting system is by no means the only way to achieve adequate redundancy and reliability, and in fact soon after BEA and de Havilland had decided to go down that route, a parallel trial was set up using a “dual-dual” concept, chosen by BOAC and Vickers for the VC10 4-engined long range aircraft. This concept was later used on the Concorde
. Some BAC 1-11
aircraft used by BEA also had a similar system.
and yaw axes manually while the autopilot controlled the “flare” or pitch. These were often done in passenger service as part of the development program. The Trident’s autopilot had separate engagement switches for the pitch and roll components, and although the normal autopilot disengagement was by means of a conventional control yoke thumb-button, it was also possible to disengage the roll channel while leaving the pitch channel engaged. In these operations the pilot had acquired full visual reference, normally well above decision height, but instead of fully disengaging the autopilot with the thumb-button, called for the second officer to latch off the roll channel only. He then controlled the lateral flight path manually while monitoring the autopilot’s continued control of the vertical flight path – ready to completely disengage it at the first sign of any deviation. While this sounds as if it may add a risk element in practice it is of course no different in principle to a training pilot monitoring a trainee’s handling during on-line training or qualification.
Having proven the reliability and accuracy of the autopilot’s ability to flare the aircraft safely, the next elements were to add in similar control of the thrust. This was similarly done by a radio altimeter signal which simply drove the autothrottle
servo
s to a flight idle setting. As the accuracy and reliability of the ground based ILS localiser was increased on a step by step basis, it was permissible to leave the roll channel engaged longer and longer, until in fact the aircraft had ceased to be airborne, and a fully automatic landing had in fact been completed. The first such landing in a BEA Trident was achieved at RAE Bedford
(by then home of BLEU) in March 1964. The first on a commercial flight with passengers aboard was achieved on flight BE 343 on 10 June 1965, with a Trident 1 G-ARPR
, from Paris to Heathrow with Captains Eric Poole and Frank Ormonroyd.
Subsequently autoland systems became available on a number of aircraft types but the primary customers were those mainly European airlines whose networks were severely affected by radiation fog. Early Autoland systems needed a relatively stable air mass and could not operate in conditions of turbulence
and in particular gusty crosswinds. In North America
it was generally the case that reduced but not zero visibility was often associated with these conditions, and if the visibility really became almost zero in, for example, blowing snow
or other precipitation
then operations would be impossible for other reasons. As a result neither airlines nor airports placed a high priority on operations in the lowest visibility. The provision of the necessary ground equipment (ILS) and associated systems for Category 3 operations was almost non existent and the major manufacturers did not regard it as a basic necessity for new aircraft. In general during the 1970s and 1980s it was available if a customer wanted it, but at such a high price (due to being a reduced production run item) that few airlines could see a cost justification for it.
(This led to the absurd situation for British Airways that as the launch customer for the Boeing 757
to replace the Trident, the brand-new “advanced” aircraft had inferior all weather operations capability compared to the fleet being broken up for scrap. An indication of this philosophical divide is the comment from a senior Boeing Vice President that he could not understand why British Airways were so concerned about the Category 3 certification, as there were only at that time two or three suitable runways in North America on which it could be fully used. It was pointed out that British Airways had some 12 such runways on its domestic network alone, four of them at its main base at Heathrow.)
In the 1980s and 1990s there was, however, increasing pressure globally from customer airlines for at least some improvements in low visibility operations; both for flight regularity and from safety considerations. At the same time it became evident that the requirement for a true “zero visibility” operation (as originally envisaged in the ICAO Category definitions) had diminished, as “clean air” laws had reduced the adverse effect of smoke adding to radiation fog in the worst affected areas. Improved avionics meant that the technology became cheaper to implement, and manufacturers raised the standard of the “basic” autopilot accuracy and reliability. The result was that on the whole the larger new airliners were now able to absorb the costs of at least Category 2 autoland systems into their basic configuration.
Simultaneously pilot organizations globally were advocating the use of Head Up Display systems primarily from a safety viewpoint. Many operators in non-sophisticated environments without many ILS equipped runways were also looking for improvements. The net effect was pressure within the industry to find alternative ways to achieve low visibility operations, such as a “Hybrid” system which used a relatively low reliability autoland system monitored by the pilots via a HUD. Alaskan
was a leader in this approach and undertook a lot of development work with Flight Dynamics and Boeing in this respect.
However a major problem with this approach was that European authorities were very reluctant to certificate such schemes as they undermined the well proven concepts of “pure” autoland systems. This impasse was broken when British Airways
became involved as a potential customer for Bombardier’s Regional Jet
, which could not accommodate a full Cat 3 autoland system, but would be required to operate in those conditions. By working with Alaska Airlines and Boeing, British Airways technical pilots were able to demonstrate that a “Hybrid” concept was feasible, and although British Airways never eventually bought the Regional Jet, this was the breakthrough needed for international approval for such systems which meant that they could reach a global market.
The wheel turned full circle when in December 2006 London Heathrow
was affected for a long period by dense fog. This airport was operating at maximum capacity in good conditions, and the imposition of low visibility procedures required to protect the localiser signal for autoland systems meant a major reduction in capacity from approximately 60 to 30 landings per hour. Since most airlines operating into Heathrow already had autoland-equipped aircraft, and thus expected to operate as normal, massive delays occurred. The worst affected airline was of course British Airways, as the largest operator at the airport.
(RAE) was formed at RAF Woodbridge and RAF Martlesham Heath
during 1945 and 1946. It was a multi-disciplinary unit, drawing staff from the RAE, Farnborough and the Telecommunications Research Establishment
, Malvern (TRE). The terms of reference were that the unit “will operate as a satellite of the RAE and will be responsible for the development on blind approach and landing of RAF, Naval and Civil aircraft”. Before the formation of BLEU, an automatic landing was made at the Telecommunications Flying Unit (TFU) of the TRE at RAF Defford
in a Boeing 247
D aircraft, DZ203
, early in 1945, using the American SCS 51 radio guidance system. That was in complete darkness, with no landing lights and all other lights obscured by the wartime blackout. There was no flare-out - the low approach speed and shallow glide angle meant that the aircraft could be allowed to fly straight onto the ground. SCS 51 was the basis for the Instrument Landing System (ILS), adopted by ICAO in 1948 .
There was an alternative system to the SCS 51 VHF USAF scheme from Col. Moseley and that was the radar-based system wholly devised, developed and trialled by F / O L. C. Barber B.Sc (Hons) and his colleagues at Defford. This system effectively gave range and height data bases which could be added to autopilot heading info and so enriched the control functions enabling automatic landing opportunities. The full technical description of this is now available in the archives at RAF Museum Hendon, reference X005-4863, and includes original photographic records of Boeing 247 DZ203.
Research during the first few years at BLEU led to the conclusion that a promising approach to blind landing would be a fully automatic system, and to the definition of the requirements for such a system, later designated Autoland. ILS was used as guidance during the approach phase, but at that time was not sufficiently accurate to complete the landing. That led to the development at BLEU of an improved FM radio altimeter for height guidance, capable of resolving height differences to 2 feet at low altitude, and a magnetic leader cable system for azimuth guidance. In collaboration with Smiths Industries Ltd.
, BLEU also developed coupling units to derive the commands to the autopilot from the guidance signals, and auto-throttle.
Components of the system were developed separately on several types of aircraft, including the Lancaster
, Viking
, Devon
and the Albemarle
. A demonstration of the techniques used was given to military and government representatives in May 1949. By 1950 the entire system had been installed on a DH Devon and the first demonstration of Autoland was given on that aircraft on 3 July 1950. Over the next 20 years, BLEU in conjunction with UK industry and the UK airworthiness authority, was responsible for almost all of the pioneering work needed to convert the concept of those experimental demonstrations into safe, accurate blind landings by large transport aircraft. The system in use during the early 2000s is basically the same as that used experimentally in 1950. The following diagram, from J S Shayler’s 1958 memorandum, shows how the different components of the system, and guidance signals, were used during the consecutive phases of an automatic landing.
, Meteor
and Canberra
aircraft. The Canberra, VN799, was acquired in 1953 but was a write-off following a crash landing in August that year due to a double engine failure, fortunately without serious injury to the crew.
At that time, Autoland had lower priority because efforts were concentrated on other projects including rapid landing of aircraft for RAF Fighter Command
, visual aids for pilots, runway approach lighting and an approach aid using DME with Barbro. That changed when Operational Requirement 947 (OR947) for automatic landing on the V-Force
bomber fleet was issued in 1954. At that time the V-bomber force was the UK’s main contribution to the strategic nuclear power of the west and all-weather operation was essential. There was also renewed interest in automatic landing for civil aviation. As the next step in the development, the flare-out and coupling units from the Devon were linked to a Smiths Type D autopilot and installed in Varsity
WF417, a much larger aircraft, capable of carrying 38 people rather than 10 in the Devon. The first fully automatic approach and landing was made by WF417 on 11 November 1954 under calm and misty conditions. A similar system was installed in Canberra WE189 to provide the first application of Autoland to jet-type aircraft. Automatic approaches and automatic landings were recorded by WE189 but the development was interrupted in April 1956 when the facilities at Woodbridge, which had the only suitable leader cable installation, ceased to be available to BLEU. Development of auto-flare and automatic kicking-off drift was continued at RAF Wittering
, but in September that year WE189, returning from tests at Wittering, crashed due to engine failure on an approach when returning to its base at Martlesham Heath. The pilot, Flt. Lt. Les Coe, and the BLEU scientist in charge of the project, Mr. Joe Birkle, were killed.
Early in 1957 BLEU moved from Martlesham Heath to a newly equipped airfield at Thurleigh
, the base for RAE Bedford. The development was continued in a third Canberra, WJ992, based on the results obtained with WE189. Experimental flights in WJ992 began late in 1957, leading to automatic landings with auto-throttle in March 1958. The following notes are from the logbook of the BLEU technologist carrying out the development: 10 March 1958 (the 38th flight of that programme): “Very little drift, about 0.3g - heights 150-55-15-0”. That was with manual throttle, but auto throttle was used on 12 March, in a strong crosswind. March 17 saw “strong tailwind, 20 - 25 kt., pronounced float“ and on June 20, after adjustments during a further 20 flights: “not bad - about 0.7 g nicely on main wheels - kicking off drift OK“. Then on June 26: “Throttles off at 50ft. Very pleasing results” and on 20 August “hands and feet off”. Recordings of automatic landings in that aircraft started on 8 July 1958, flight no. 69. Results for automatic landings in Canberra aircraft were quoted by Wood in 1957 and published by Charnley in 1959, as for a “medium size jet aircraft”. By October 1958, BLEU had completed over 2,000 fully automatic landings, mainly in the Canberra and Varsity aircraft.
The V-bomber project to install and develop Autoland on Vulcan
XA899, originally classified as Secret
, ran in parallel with the Canberra and Varsity work. The first automatic landings in the Vulcan were made between December 1959 and April 1960. Trials were carried out later that year and the system was accepted for military service in 1961.
It was recognised that leader cable would be impractical at some airports, but that it could be dispensed with if improvements could be made to ILS. Some improvement resulted from a narrow beam localizer aerial system developed by BLEU during the early 1950s and by 1958 automatic landings had been made using only ILS localiser for azimuth guidance. That required a good site but by the early 1960s radically new aerial designs for the ILS transmitters developed by Standard Telephones & Cables
(ST&C) improved ILS to an extent that leader cable could be dispensed with.
For many years there had been discussions between the UK Ministry of Aviation
and the US Federal Aviation Agency
(FAA) on guidance aids for landing in poor visibility. The Americans favoured a “pilot in the loop” technique, with improved aids for the pilot, over the fully automatic system preferred in the UK. In 1961, to gain experience with “the BLEU automatic landing system” the FAA sent a Douglas DC-7
to RAE Bedford for the system to be installed and tested. After that and further tests on return to Atlantic City, the FAA were convinced and thereafter strongly supported a fully automatic solution to the all-weather problem which later was adopted internationally.
Up to that stage the Autoland system had been realised only as a “single-lane” or single channel system, without any redundancy to protect against equipment failure. During the late 1950s and early 1960s increased cooperation between BLEU, the UK Civil Aviation Authority (CAA) and companies in the aviation industry with BEA and BOAC
led to the definition of safety requirements in terms of a specification for maximum tolerable failure rates. In 1961, the UK Air Registration Board (ARB) of the CAA issued a working document BCAR 367 “Airworthiness Requirements for Autoflare and Automatic Landing” which formed the basis for the definitions for weather visibility categories adopted by ICAO in 1965. In 1959, contracts were placed by BEA and BOAC to develop automatic landing, based on Autoland, for the Trident and the VC10. The Trident used a triplex system with no common elements, so that a failure in one of the three channels could be detected and that channel eliminated. “Nuisance disconnects” were an early problem with that system, eventually solved by the industry, using torque switches with a controlled degree of lost motion. The introduction of Autoland for Category 3 operation in BEA’s Trident fleet required a huge effort by BEA, Hawker Siddeley Aviation, Smiths Industries and BLEU. A triplex system was also developed by Smiths and BLEU for the RAF’s Belfast
freighter.
The VC10 used an Elliott
duplicated monitored system. Later, the Concorde system was basically an improved version of the VC10 one, benefiting from advances in electronic circuit technology during the late 1960s. By 1980, the Trident had carried out more than 50,000 in-service automatic landings. The VC10 accrued 3,500 automatic landings before use of the system was curtailed in 1974 for economic reasons. By 1980, Concorde had performed nearly 1,500 automatic landings in passenger service.
BLEU (renamed the Operational Systems Division of RAE in 1974) continued to play a leading role in the development of aircraft guidance systems, using a variety of aircraft including DH Comet
, BAC 1-11
, HS 748 (to replace the Varsities, which had been the main “work horses“ for BLEU experiments for more than a decade) and VC-10 until the closure of RAE Bedford in 1994.
For CAT IIIc, the flight control computer will continue to accept deviations from the localizer and use the rudder to maintain the aircraft on the localizer (which is aligned with the runway centerline.) On landing the spoilers will deploy (these are surfaces on the top of the wing towards the trailing edge) which causes airflow over the wing to become turbulent, destroying lift. At the same time the autobrake system will apply the brakes and the thrust reversers will activate to maintain a deceleration profile. The anti-skid system will modulate brake pressure to keep all wheels turning. As the speed decreases, the rudder will lose effectiveness and the pilot will need to control the direction of the airplane using nose wheel steering, a system which typically is not connected to the flight control computer.
From an avionics safety perspective, a CAT IIIc landing is the "worst case scenario" for safety analysis because a failure of the automatic systems from flare through the roll-out could easily result in a "hard over" (where a control surface deflects fully in one direction.) This would happen so fast that the flight crew may not effectively respond. For this reason Autoland systems are designed to incorporate a high degree of redundancy so that a single failure of any part of the system can be tolerated (fail active) and a second failure can be detected – at which point the autoland system will turn itself off (uncouple, fail passive). One way of accomplishing this is to have “three of everything.” Three ILS receivers, three radio altimeters, three flight control computers, and three ways of controlling the flight surfaces. The three flight control computers all work in parallel and are in constant cross communications, comparing their inputs (ILS receivers and radio altimeters) with those of the other two flight control computers. If there is a difference in inputs, then a computer can “vote out” the deviant input and will notify the other computers that “RA1 is faulty.” If the outputs don’t match a computer can declare itself as faulty and, if possible, take itself off line.
When the pilot “arms” the system (prior to capture of either the localizer or glideslope) the flight control computers perform an extensive series of Built In Tests (BIT). For a CAT III landing, all the sensors and all the flight computers must be “in good health” before the pilot receives an AUTOLAND ARM (These are generic indications and will vary depending on equipment supplier and aircraft manufacturer) indication. If part of the system is in error, then an indication such as “APPROACH ONLY” would be presented to inform the flight crew that a CAT III landing is not possible. If the system is properly in the ARM mode, when the ILS receiver detects the localizer, then the autoland system mode will change to ‘LOCALIZER CAPTURE’ and the flight control computer will turn the aircraft into the localizer and fly along the localizer. A typical approach will have the aircraft come in “below the glideslope” (vertical guidance) so the airplane will fly along the localizer (aligned to the runway centerline) until the glideslope is detected at which point the autoland mode will change to CAT III and the aircraft will be flown by the flight control computer along the localizer and glideslope beams. The antennas for these systems are not at the runway touch down point however, with the localizer being some distance beyond the runway. However at a predefined distance above the ground the aircraft will initiate the flare maneuver, maintain the same heading, and settle onto the runway within the designated touch down zone.
If the autoland system loses redundancy prior to the decision height, then an AUTOLAND FAULT will be displayed to the flight crew at which point the crew can elect to continue as a CAT II approach or if this is not possible because of weather conditions, then the crew would need to initiate a go-around and proceed to an alternative airport.
If a single failure occurs below decision height AUTOLAND FAULT will be displayed, however at that point the aircraft is committed to landing and the autoland system will remain engaged, controlling the aircraft on only two systems until the pilot completes the rollout and brings the aircraft to a full stop on the runway or turns off the runway onto a taxiway. This is termed “fail active.” However in this state the autoland system is “one fault away” from disengaging so the AUTOLAND FAULT indication should inform the flight crew to monitor the system behavior very careful and be ready to take control immediately. The system is still fail active and is still performing all necessary cross checks so that if one of the flight control computers decides that the right thing to do is order a full deflection of a control surface, the other computer will detect that there is a difference in the commands and this will take both computers off line (fail passive) at which time the flight crew must immediately take control of the aircraft as the automatic systems have done the safe thing by taking themselves off line.
During system design, the predicted reliability numbers for the individual equipment which makes up the entire autoland system (sensors, computers, controls, and so forth) are combined and an overall probability of failure is calculated. As the “threat” exists primarily during the flare through roll-out, this “exposure time” is used and the overall failure probability must be less than one in a million.
) crashed about a mile (1500m) short of the runway at Amsterdam Schiphol Airport
. The Dutch Safety Board
published preliminary findings only one week after the crash, suggesting the autoland played a key role in downing the plane.
According to the Flight Data Recorder
, the airplane was on a full autoland approach at a height of 1950 ft / 595 m the left Radio Altimeter
had been misreporting a height of -8 ft. The autoland system responded accordingly and configured the plane for touchdown, idling the engines. This made the plane lose speed and stall
. When the flight crew received stall-warnings, they were already too low and too slow to recover. As a secondary factor, the Safety Board suggested the crew did not have a visual ground reference because of foggy conditions.
At this point it is unclear how failure of one radio altimeter could cause a crash during an autoland approach. The autoland system has obviously been designed to be fail-safe and the airplane was equipped with more than one radio altimeter.
The final investigation report was released on 6 May 2010.
Aviation
Aviation is the design, development, production, operation, and use of aircraft, especially heavier-than-air aircraft. Aviation is derived from avis, the Latin word for bird.-History:...
, autoland describes a system that fully automates
Automation
Automation is the use of control systems and information technologies to reduce the need for human work in the production of goods and services. In the scope of industrialization, automation is a step beyond mechanization...
the landing
Landing
thumb|A [[Mute Swan]] alighting. Note the ruffled feathers on top of the wings indicate that the swan is flying at the [[Stall |stall]]ing speed...
phase of an aircraft
Aircraft
An aircraft is a vehicle that is able to fly by gaining support from the air, or, in general, the atmosphere of a planet. An aircraft counters the force of gravity by using either static lift or by using the dynamic lift of an airfoil, or in a few cases the downward thrust from jet engines.Although...
's flight, with the human crew merely supervising the process.
Description
Autoland systems were designed to make landingLanding
thumb|A [[Mute Swan]] alighting. Note the ruffled feathers on top of the wings indicate that the swan is flying at the [[Stall |stall]]ing speed...
possible in visibility too poor to permit any form of visual landing, although they can be used at any level of visibility. They are usually used when visibility is less than 600 meters RVR
Runway visual range
Runway Visual Range is a term used in aviation meteorology to define the distance over which a pilot of an aircraft on the centreline of the runway can see the runway surface markings delineating the runway or identifying its centre line...
and/or in adverse weather conditions, although limitations do apply for most aircraft—for example, for a Boeing 747-400
Boeing 747-400
The Boeing 747-400 is a major development and the best-selling model of the Boeing 747 family of jet airliners. While retaining the four-engine wide-body layout of its predecessors, the 747-400 embodies numerous technological and structural changes to produce a more efficient airframe...
the limitations are a maximum headwind of 25 kts, a maximum tailwind
Tailwind
A tailwind is a wind that blows in the direction of travel of an object, while a headwind blows against the direction of travel. A tailwind increases the object's speed and reduces the time required to reach its destination, while a headwind has the opposite effect...
of 10 kts, a maximum crosswind
Crosswind
A crosswind is any wind that has a perpendicular component to the line or direction of travel. In aviation, a crosswind is the component of wind that is blowing across the runway making landings and take-offs more difficult than if the wind were blowing straight down the runway...
component of 25 kts, and a maximum crosswind with one engine inoperative of five knots. They may also include automatic braking to a full stop once the aircraft is on the ground, in conjunction with the autobrake system
Autobrake
An autobrake is a type of automatic wheel-based hydraulic brake system for advanced airplanes. The autobrake is normally enabled during takeoff and landing procedures, when the aircraft's longitudinal deceleration system can be handled by the automated systems of the aircraft itself in order to...
, and sometimes auto deployment of spoilers
Spoiler (aeronautics)
In aeronautics, a spoiler is a device intended to reduce lift in an aircraft. Spoilers are plates on the top surface of a wing which can be extended upward into the airflow and spoil it. By doing so, the spoiler creates a carefully controlled stall over the portion of the wing behind it, greatly...
and thrust reversers.
Autoland may be used for any suitably approved Instrument Landing System
Instrument Landing System
An instrument landing system is a ground-based instrument approach system that provides precision guidance to an aircraft approaching and landing on a runway, using a combination of radio signals and, in many cases, high-intensity lighting arrays to enable a safe landing during instrument...
(ILS) or Microwave Landing System
Microwave landing system
A microwave landing system is an all-weather, precision landing system originally intended to replace or supplement instrument landing systems...
(MLS) approach, and is sometimes used to maintain currency of the aircraft and crew, as well as for its main purpose of assisting an aircraft landing in low visibility and/or bad weather.
Autoland requires the use of a radar altimeter
Radar altimeter
A radar altimeter, radio altimeter, low range radio altimeter or simply RA measures altitude above the terrain presently beneath an aircraft or spacecraft...
to determine the aircraft's height
Altitude
Altitude or height is defined based on the context in which it is used . As a general definition, altitude is a distance measurement, usually in the vertical or "up" direction, between a reference datum and a point or object. The reference datum also often varies according to the context...
above the ground very precisely so as to initiate the landing flare
Landing flare
The landing flare is a maneuver or stage during the landing of an aircraft. The nose of the plane is raised, slowing the descent rate, and the proper attitude is set to prepare for touchdown. In parachuting, the landing flare is the part of the parachute landing fall preceding ground contact, and...
at the correct height (usually about 50 feet). The localizer
Localizer
In aviation, a localizer is one of the components of an Instrument Landing System , and it provides runway centerline guidance to aircraft. In some cases, a course projected by localizer is at an angle to the runway . It is then called a Localizer Type Directional Aid...
signal of the ILS may be used for lateral control even after touchdown until the pilot disengages the autopilot
Autopilot
An autopilot is a mechanical, electrical, or hydraulic system used to guide a vehicle without assistance from a human being. An autopilot can refer specifically to aircraft, self-steering gear for boats, or auto guidance of space craft and missiles...
. For safety reasons, once autoland is engaged and the ILS signals have been acquired by the autoland system, it will proceed to landing without further intervention, and can be disengaged only by completely disconnecting the autopilot (this prevents accidental disengagement of the autoland system at a critical moment). At least two and often three independent autopilot systems work in concert to carry out autoland, thus providing redundant protection against failures. Most autoland systems can operate with a single autopilot in an emergency, but they are only certified when multiple autopilots are available.
The autoland system's response rate to external stimuli work very well in conditions of reduced visibility and relatively calm or steady winds, but the purposefully limited response rate means they are not generally smooth in their responses to varying wind shear
Wind shear
Wind shear, sometimes referred to as windshear or wind gradient, is a difference in wind speed and direction over a relatively short distance in the atmosphere...
or gusting wind conditions - i.e. not able to compensate in all dimensions rapidly enough - to safely permit their use.
The first aircraft to be certified to CAT III standards, on 28 December 1968 , was the Sud Aviation Caravelle
Sud Aviation Caravelle
The Sud Aviation SE 210 Caravelle was the first short/medium-range jet airliner produced by the French Sud Aviation firm starting in 1955 . The Caravelle was one of the more successful European first generation jetliners, selling throughout Europe and even penetrating the United States market, with...
, followed by the Hawker-Siddeley HS.121 Trident in May 1972 (CAT IIIA) and to CAT IIIB during 1975. The Trident had been certified to CAT II on 7 February 1968.
Autoland capability has seen the most rapid adoption in areas and on aircraft that must frequently operate in very poor visibility. Airports troubled by fog on a regular basis are prime candidates for Category III approaches, and including autoland capability on jet airliner
Jet airliner
A jet airliner is an airliner that is powered by jet engines. This term is sometimes contracted to jetliner or jet.In contrast to today's relatively fuel-efficient, turbofan-powered air travel, first generation jet airliner travel was noisy and fuel inefficient...
s helps reduce the likelihood that they will be forced to divert by bad weather.
Autoland is highly accurate. In his 1959 paper John Charnley, then Superintendent of the UK Royal Aircraft Establishment's Blind Landing Experimental Unit (BLEU), concluded a discussion of statistical results by saying that "It is fair to claim, therefore, that not only will the automatic system land the aircraft when the weather prevents the human pilot, it also performs the operation much more precisely".
Traditionally autoland systems have been very expensive, and have been rare on small aircraft. However, as display technology has developed the addition of a Head Up Display (HUD) allows for a trained pilot to manually fly the aircraft using guidance cues from the flight guidance system. This significantly reduces the cost of operating in very low visibility, and allows aircraft which are not equipped for automatic landings to make a manual landing safely at lower levels of look ahead visibility or runway visual range (RVR). Alaska Airlines
Alaska Airlines
Alaska Airlines is an airline based in the Seattle suburb of SeaTac, Washington in the United States. The airline originated in 1932 as McGee Airways. After many mergers with and acquisitions of other airlines, including Star Air Service, it became known as Alaska Airlines in 1944...
was the first airline in the world to manually land a passenger-carrying jet (Boeing 737
Boeing 737
The Boeing 737 is a short- to medium-range, twin-engine narrow-body jet airliner. Originally developed as a shorter, lower-cost twin-engine airliner derived from Boeing's 707 and 727, the 737 has developed into a family of nine passenger models with a capacity of 85 to 215 passengers...
) in FAA
Federal Aviation Administration
The Federal Aviation Administration is the national aviation authority of the United States. An agency of the United States Department of Transportation, it has authority to regulate and oversee all aspects of civil aviation in the U.S...
Category III weather (dense fog) made possible with the Head-Up Guidance System
Background
Commercial aviation autoland was initially developed in Great BritainGreat Britain
Great Britain or Britain is an island situated to the northwest of Continental Europe. It is the ninth largest island in the world, and the largest European island, as well as the largest of the British Isles...
, as a result of the frequent occurrence of very low visibility conditions in winter in North-west Europe. These occur particularly when anticyclone
Anticyclone
An anticyclone is a weather phenomenon defined by the United States' National Weather Service's glossary as "[a] large-scale circulation of winds around a central region of high atmospheric pressure, clockwise in the Northern Hemisphere, counterclockwise in the Southern Hemisphere"...
s are in place over central Europe in November/December/January when temperatures are low, and radiation fog forms easily in relatively stable air. The severity of this type of fog was exacerbated in the late 1940s and 1950s by the prevalence of carbon and other smoke particles in the air from coal
Coal
Coal is a combustible black or brownish-black sedimentary rock usually occurring in rock strata in layers or veins called coal beds or coal seams. The harder forms, such as anthracite coal, can be regarded as metamorphic rock because of later exposure to elevated temperature and pressure...
burning heating and power generation. Cities particularly affected included the main [UK] centres, and their airports such as London Heathrow, Gatwick, Manchester
Manchester
Manchester is a city and metropolitan borough in Greater Manchester, England. According to the Office for National Statistics, the 2010 mid-year population estimate for Manchester was 498,800. Manchester lies within one of the UK's largest metropolitan areas, the metropolitan county of Greater...
, Birmingham
Birmingham
Birmingham is a city and metropolitan borough in the West Midlands of England. It is the most populous British city outside the capital London, with a population of 1,036,900 , and lies at the heart of the West Midlands conurbation, the second most populous urban area in the United Kingdom with a...
and Glasgow
Glasgow
Glasgow is the largest city in Scotland and third most populous in the United Kingdom. The city is situated on the River Clyde in the country's west central lowlands...
, as well as European cities such as Amsterdam
Amsterdam
Amsterdam is the largest city and the capital of the Netherlands. The current position of Amsterdam as capital city of the Kingdom of the Netherlands is governed by the constitution of August 24, 1815 and its successors. Amsterdam has a population of 783,364 within city limits, an urban population...
, Brussels
Brussels
Brussels , officially the Brussels Region or Brussels-Capital Region , is the capital of Belgium and the de facto capital of the European Union...
, Paris
Paris
Paris is the capital and largest city in France, situated on the river Seine, in northern France, at the heart of the Île-de-France region...
, Zurich
Zürich
Zurich is the largest city in Switzerland and the capital of the canton of Zurich. It is located in central Switzerland at the northwestern tip of Lake Zurich...
and Milan
Milan
Milan is the second-largest city in Italy and the capital city of the region of Lombardy and of the province of Milan. The city proper has a population of about 1.3 million, while its urban area, roughly coinciding with its administrative province and the bordering Province of Monza and Brianza ,...
. Visibility at these times could become as low as a few feet (hence the “London fog
Pea soup fog
Pea soup, or a pea souper, is a type of visible air pollution, a thick and often yellowish smog caused by the burning of soft coal. Smog, a portmanteau of hi"smoke" and "fog", can be lethal, and even the healthy may be inconvenienced by it.-London:...
s” of movie fame) and when combined with the soot created lethal long-persistence smog: these conditions led to the passing of the UK’s “Clean Air Act
Clean Air Act 1956
The Clean Air Act 1956 was an Act of the Parliament of the United Kingdom passed in response to London's Great Smog of 1952. It was in effect until 1964, and sponsored by the Ministry of Housing and Local Government in England and the Department of Health for Scotland.The Act introduced a number of...
” which banned the burning of smoke-producing fuel.
Post 1945, the British government had established two state-owned airline corporations – British European Airways
British European Airways
British European Airways or British European Airways Corporation was a British airline which existed from 1946 until 1974. The airline operated European and North African routes from airports around the United Kingdom...
(BEA) and British Overseas Airways Corporation
British Overseas Airways Corporation
The British Overseas Airways Corporation was the British state airline from 1939 until 1946 and the long-haul British state airline from 1946 to 1974. The company started life with a merger between Imperial Airways Ltd. and British Airways Ltd...
(BOAC), which were subsequently to be merged into today’s British Airways
British Airways
British Airways is the flag carrier airline of the United Kingdom, based in Waterside, near its main hub at London Heathrow Airport. British Airways is the largest airline in the UK based on fleet size, international flights and international destinations...
. BEA’s route network focused on airports in the UK and Europe, and hence its services were particularly prone to disruption by these particular conditions.
During the immediate post-war period, BEA suffered a number of accidents during approach and landing in poor visibility, which caused it to focus on the problems of how pilots could land safely in such conditions. A major breakthrough came with the recognition that in such low visibility the very limited visual information available (lights and so on) was extraordinarily easy to misinterpret, especially when the requirement to assess it was combined with a requirement to simultaneously fly the aircraft on instruments. This led to the development of what is now widely understood as the “monitored approach” procedure whereby one pilot is assigned the task of accurate instrument flying while the other assesses the visual cues available at decision height, taking control to execute the landing once satisfied that the aircraft is in fact in the correct place and on a safe trajectory for a landing. The result was a major improvement in the safety of operations in low visibility, and as the concept clearly incorporates vast elements of what is now known as Crew Resource Management
Crew Resource Management
Crew resource management or Cockpit resource management is a procedure and training system in systems where human error can have devastating effects. Used primarily for improving air safety, CRM focuses on interpersonal communication, leadership, and decision making in the cockpit...
(although predating this phrase by some three decades) it was expanded to encompass a far broader spectrum of operations than just low visibility.
However, associated with this “human factors” approach was a recognition that improved autopilots could play a major part in low visibility landings. The components of all landings are the same, involving navigation from a point at altitude “en route” to a point where the wheels are on the desired runway. This navigation is accomplished using information from either external, physical, visual cues or from synthetic cues such as flight instruments. At all times there must be sufficient total information to ensure that the aircraft’s position and trajectory (vertical and horizontal) are correct. The problem with low visibility operations is that the visual cues may be reduced to effectively zero, and hence there is an increased reliance on “synthetic” information. The dilemma faced by BEA was to find a way to operate without cues, because this situation occurred on its network with far greater frequency than on that of any other airline. It was particularly prevalent at its home base – London – which could effectively be closed for days at a time.
The Development of Autoland
The UK government's aviation research facilities including the Blind Landing Experimental Unit (BLEU) set up during 1945/46 at RAF Martlesham HeathRAF Martlesham Heath
RAF Martlesham Heath is a former Royal Air Force airfield in England. The field is located 1½ miles SW of Woodbridge, Suffolk.- RFC/RAF prewar use:Martlesham Heath was first used as a Royal Flying Corps airfield during World War I...
and RAF Woodbridge
RAF Woodbridge
Royal Air Force Station Woodbridge, more commonly referred to as RAF Woodbridge, is a former Royal Air Force military airbase situated to the east of Woodbridge in the county of Suffolk, England...
to research all the relevant factors. The pioneering work by BLEU is described below. BEA’s flight technical personnel were heavily involved in BLEU's activities in the development of Autoland for its Trident fleet from the late 1950s. The work included analysis of fog structures, human perception, instrument
Flight instruments
Flight instruments are the instruments in the cockpit of an aircraft that provide the pilot with information about the flight situation of that aircraft, such as height, speed and altitude...
design, and lighting cues amongst many others. After further accidents, this work also led to the development of aircraft operating minima in the form we know them today. In particular, it led to the requirement that a minimum visibility must be reported as available before the aircraft may commence an approach – a concept that had not existed previously. The basic concept of a “target level of safety” (10-7) and of the analysis of “fault trees” to determine probability of failure events stemmed from about this period.
The basic concept of autoland flows from the fact that an autopilot could be set up to track an artificial signal such as an Instrument Landing System
Instrument Landing System
An instrument landing system is a ground-based instrument approach system that provides precision guidance to an aircraft approaching and landing on a runway, using a combination of radio signals and, in many cases, high-intensity lighting arrays to enable a safe landing during instrument...
(ILS) beam more accurately than a human pilot could – not least because of the inadequacies of the electro-mechanical flight instruments of the time. If the ILS beam could be tracked to a lower height then clearly the aircraft would be nearer to the runway when it reached the limit of ILS usability, and nearer to the runway less visibility would be required to see sufficient cues to confirm the aircraft position and trajectory. With an angular signal system such as ILS, as altitude decreases all tolerances must be decreased – in both the aircraft system and the input signal - to maintain the required degree of safety. This is because certain other factors – physical and physiological laws which govern for example the pilot’s ability to make the aircraft respond – remain constant. For example, at 300 feet above the runway on a standard 3 degree approach the aircraft will be 6000 feet from the touchdown point, and at 100 feet it will be 2000 feet out. If a small course correction needs 10 seconds to be effected, at 180kts it will take 3000 ft. It will be possible if initiated at 300 feet of height, but not at 100 feet. Consequently only a smaller course correction can be tolerated at the lower height, and the system needs to be more accurate.
This imposes a requirement for the GROUND based guidance element to conform to specific standards, as well as the airborne elements. Thus, while an aircraft may be equipped with an autoland system, it will be totally unusable without the appropriate ground environment. Similarly, it requires a crew trained in all aspects of the operation to recognise potential failures in both airborne and ground equipment, and to react appropriately, to be able to use the system in the circumstances from which it is intended. Consequently, the low visibility operations categories “Cat I, Cat II and Cat III) apply to all 3 elements in the landing – the aircraft equipment, the ground environment, and the crew. The result of all this is to create a spectrum of low visibility equipment, in which an aircraft’s “autoland” autopilot is just one component.
The development of these systems proceeded by recognising that although the ILS would be the source of the guidance, the ILS itself contains lateral and vertical elements that have rather different characteristics. In particular, the vertical element (glideslope) originates from the projected touchdown point of the approach, i.e. typically 1000 ft from the beginning of the runway
Runway
According to ICAO a runway is a "defined rectangular area on a land aerodrome prepared for the landing and take-off of aircraft." Runways may be a man-made surface or a natural surface .- Orientation and dimensions :Runways are named by a number between 01 and 36, which is generally one tenth...
, while the lateral element (localiser) originates from beyond the far end. The transmitted glideslope therefore becomes irrelevant soon after the aircraft has reached the runway threshold, and in fact the aircraft has of course to enter its landing mode and reduce its vertical velocity quite a long time before it passes the glideslope transmitter. The inaccuracies in the basic ILS could be seen in that it was suitable for use down to 200 ft. only (Cat I), and similarly no autopilot was suitable for or approved for use below this height.
The lateral guidance from the ILS Localiser would however be usable right to the end of the landing roll, and hence is used to feed the rudder
Rudder
A rudder is a device used to steer a ship, boat, submarine, hovercraft, aircraft or other conveyance that moves through a medium . On an aircraft the rudder is used primarily to counter adverse yaw and p-factor and is not the primary control used to turn the airplane...
channel of the autopilot after touchdown. As aircraft approached the transmitter its speed is obviously reducing and rudder effectiveness diminishes, compensating to some extent for the increased sensitivity of the transmitted signal. More significantly however it means the safety of the aircraft is still dependent on the ILS during rollout. Furthermore, as it taxis off the runway and down any parallel taxiway, it itself acts a reflector and can interfere with the localiser signal. This means that it can affect the safety of any following aircraft still using the localiser. As a result, such aircraft cannot be allowed to rely on that signal until the first aircraft is well clear of the runway and the “Cat. 3 protected area”.
The result is that when these low visibility operations are taking place, operations on the ground affect operations in the air much more than in good visibility, when pilots can see what is happening. At very busy airports, this results in restrictions in movement which can in turn severely impact the airport’s capacity. In short, very low visibility operations such as autoland can only be conducted when aircraft, crews, ground equipment and air and ground traffic control ALL comply with more stringent requirements than normal.
The first “commercial development” automatic landings (as opposed to pure experimentation) were achieved through realising that the vertical and lateral paths had different “rules”. Although the localiser signal would be present throughout the landing, the glide slope had to be disregarded before touchdown in any event. It was recognised that if the aircraft had arrived at Decision Height (200 ft) on a correct, stable approach path – a prerequisite for a safe landing – it would have momentum along that path. Consequently, the autoland system could discard the glideslope information when it became unreliable (i.e. at 200 ft), and use of pitch information derived from the last several seconds of flight would ensure to the required degree of reliability that the descent rate (and hence adherence to the correct profile) would remain constant. This “ballistic
Ballistics
Ballistics is the science of mechanics that deals with the flight, behavior, and effects of projectiles, especially bullets, gravity bombs, rockets, or the like; the science or art of designing and accelerating projectiles so as to achieve a desired performance.A ballistic body is a body which is...
” phase would end at the height when it became necessary to increase pitch and reduce power to enter the landing flare. The pitch change occurs over the runway in the 1000 horizontal feet between the threshold and the glide slope antenna, and so can be accurately triggered by radio altimeter.
Autoland was first developed in BLEU and RAF aircraft, and later for BEA's Trident
Hawker Siddeley Trident
The Hawker Siddeley HS 121 Trident was a British short/medium-range three-engined jet airliner designed by de Havilland and built by Hawker Siddeley in the 1960s and 1970s...
fleet, which entered service in the early 1960s. The Trident was a 3 engined jet
Jet engine
A jet engine is a reaction engine that discharges a fast moving jet to generate thrust by jet propulsion and in accordance with Newton's laws of motion. This broad definition of jet engines includes turbojets, turbofans, rockets, ramjets, pulse jets...
built by de Havilland
De Havilland
The de Havilland Aircraft Company was a British aviation manufacturer founded in 1920 when Airco, of which Geoffrey de Havilland had been chief designer, was sold to BSA by the owner George Holt Thomas. De Havilland then set up a company under his name in September of that year at Stag Lane...
with a similar configuration to the Boeing 727, and was extremely sophisticated for its time. BEA had specified a “zero visibility” capability for it to deal with the problems of its fog-prone network. It had an autopilot designed to provide the necessary redundancy to tolerate failures during autoland, and it was this design which had “triple redundancy.
This autopilot used three simultaneous processing channels each giving a physical output. The fail-safe
Fail-safe
A fail-safe or fail-secure device is one that, in the event of failure, responds in a way that will cause no harm, or at least a minimum of harm, to other devices or danger to personnel....
element was provided by a “voting” procedure using torque switches, whereby it was accepted that in the event that one channel differed from the other two, the probability of TWO similar simultaneous failures could be discounted and the two channels in agreement would “out-vote” and disconnect the third channel. However, this triple-voting system is by no means the only way to achieve adequate redundancy and reliability, and in fact soon after BEA and de Havilland had decided to go down that route, a parallel trial was set up using a “dual-dual” concept, chosen by BOAC and Vickers for the VC10 4-engined long range aircraft. This concept was later used on the Concorde
Concorde
Aérospatiale-BAC Concorde was a turbojet-powered supersonic passenger airliner, a supersonic transport . It was a product of an Anglo-French government treaty, combining the manufacturing efforts of Aérospatiale and the British Aircraft Corporation...
. Some BAC 1-11
BAC One-Eleven
The British Aircraft Corporation One-Eleven, also known as the BAC-111, BAC-1-11 or BAC 1-11, was a British short-range jet airliner of the 1960s and 1970s...
aircraft used by BEA also had a similar system.
Autoland for Civil Aviation
The earliest experimental autopilot-controlled landings in commercial service were not in fact full auto LANDINGS but were termed “auto-flare”. In this mode the pilot controlled the rollFlight dynamics
Flight dynamics is the science of air vehicle orientation and control in three dimensions. The three critical flight dynamics parameters are the angles of rotation in three dimensions about the vehicle's center of mass, known as pitch, roll and yaw .Aerospace engineers develop control systems for...
and yaw axes manually while the autopilot controlled the “flare” or pitch. These were often done in passenger service as part of the development program. The Trident’s autopilot had separate engagement switches for the pitch and roll components, and although the normal autopilot disengagement was by means of a conventional control yoke thumb-button, it was also possible to disengage the roll channel while leaving the pitch channel engaged. In these operations the pilot had acquired full visual reference, normally well above decision height, but instead of fully disengaging the autopilot with the thumb-button, called for the second officer to latch off the roll channel only. He then controlled the lateral flight path manually while monitoring the autopilot’s continued control of the vertical flight path – ready to completely disengage it at the first sign of any deviation. While this sounds as if it may add a risk element in practice it is of course no different in principle to a training pilot monitoring a trainee’s handling during on-line training or qualification.
Having proven the reliability and accuracy of the autopilot’s ability to flare the aircraft safely, the next elements were to add in similar control of the thrust. This was similarly done by a radio altimeter signal which simply drove the autothrottle
Autothrottle
An autothrottle allows a pilot to control the power setting of an aircraft's engines by specifying a desired flight characteristic, rather than manually controlling fuel flow...
servo
Servomechanism
thumb|right|200px|Industrial servomotorThe grey/green cylinder is the [[Brush |brush-type]] [[DC motor]]. The black section at the bottom contains the [[Epicyclic gearing|planetary]] [[Reduction drive|reduction gear]], and the black object on top of the motor is the optical [[rotary encoder]] for...
s to a flight idle setting. As the accuracy and reliability of the ground based ILS localiser was increased on a step by step basis, it was permissible to leave the roll channel engaged longer and longer, until in fact the aircraft had ceased to be airborne, and a fully automatic landing had in fact been completed. The first such landing in a BEA Trident was achieved at RAE Bedford
RAE Bedford
RAE Bedford based near the village of Thurleigh, north of the town of Bedford in England, has been the site of major aircraft experimental development work....
(by then home of BLEU) in March 1964. The first on a commercial flight with passengers aboard was achieved on flight BE 343 on 10 June 1965, with a Trident 1 G-ARPR
Aircraft registration
An aircraft registration is a unique alphanumeric string that identifies a civil aircraft, in similar fashion to a licence plate on an automobile...
, from Paris to Heathrow with Captains Eric Poole and Frank Ormonroyd.
Subsequently autoland systems became available on a number of aircraft types but the primary customers were those mainly European airlines whose networks were severely affected by radiation fog. Early Autoland systems needed a relatively stable air mass and could not operate in conditions of turbulence
Turbulence
In fluid dynamics, turbulence or turbulent flow is a flow regime characterized by chaotic and stochastic property changes. This includes low momentum diffusion, high momentum convection, and rapid variation of pressure and velocity in space and time...
and in particular gusty crosswinds. In North America
North America
North America is a continent wholly within the Northern Hemisphere and almost wholly within the Western Hemisphere. It is also considered a northern subcontinent of the Americas...
it was generally the case that reduced but not zero visibility was often associated with these conditions, and if the visibility really became almost zero in, for example, blowing snow
Snow
Snow is a form of precipitation within the Earth's atmosphere in the form of crystalline water ice, consisting of a multitude of snowflakes that fall from clouds. Since snow is composed of small ice particles, it is a granular material. It has an open and therefore soft structure, unless packed by...
or other precipitation
Rain
Rain is liquid precipitation, as opposed to non-liquid kinds of precipitation such as snow, hail and sleet. Rain requires the presence of a thick layer of the atmosphere to have temperatures above the melting point of water near and above the Earth's surface...
then operations would be impossible for other reasons. As a result neither airlines nor airports placed a high priority on operations in the lowest visibility. The provision of the necessary ground equipment (ILS) and associated systems for Category 3 operations was almost non existent and the major manufacturers did not regard it as a basic necessity for new aircraft. In general during the 1970s and 1980s it was available if a customer wanted it, but at such a high price (due to being a reduced production run item) that few airlines could see a cost justification for it.
(This led to the absurd situation for British Airways that as the launch customer for the Boeing 757
Boeing 757
The Boeing 757 is a mid-size, narrow-body twin-engine jet airliner manufactured by Boeing Commercial Airplanes. Passenger versions of the twinjet have a capacity of 186 to 289 persons and a maximum range of , depending on variant and cabin configuration...
to replace the Trident, the brand-new “advanced” aircraft had inferior all weather operations capability compared to the fleet being broken up for scrap. An indication of this philosophical divide is the comment from a senior Boeing Vice President that he could not understand why British Airways were so concerned about the Category 3 certification, as there were only at that time two or three suitable runways in North America on which it could be fully used. It was pointed out that British Airways had some 12 such runways on its domestic network alone, four of them at its main base at Heathrow.)
In the 1980s and 1990s there was, however, increasing pressure globally from customer airlines for at least some improvements in low visibility operations; both for flight regularity and from safety considerations. At the same time it became evident that the requirement for a true “zero visibility” operation (as originally envisaged in the ICAO Category definitions) had diminished, as “clean air” laws had reduced the adverse effect of smoke adding to radiation fog in the worst affected areas. Improved avionics meant that the technology became cheaper to implement, and manufacturers raised the standard of the “basic” autopilot accuracy and reliability. The result was that on the whole the larger new airliners were now able to absorb the costs of at least Category 2 autoland systems into their basic configuration.
Simultaneously pilot organizations globally were advocating the use of Head Up Display systems primarily from a safety viewpoint. Many operators in non-sophisticated environments without many ILS equipped runways were also looking for improvements. The net effect was pressure within the industry to find alternative ways to achieve low visibility operations, such as a “Hybrid” system which used a relatively low reliability autoland system monitored by the pilots via a HUD. Alaskan
Alaska Airlines
Alaska Airlines is an airline based in the Seattle suburb of SeaTac, Washington in the United States. The airline originated in 1932 as McGee Airways. After many mergers with and acquisitions of other airlines, including Star Air Service, it became known as Alaska Airlines in 1944...
was a leader in this approach and undertook a lot of development work with Flight Dynamics and Boeing in this respect.
However a major problem with this approach was that European authorities were very reluctant to certificate such schemes as they undermined the well proven concepts of “pure” autoland systems. This impasse was broken when British Airways
British Airways
British Airways is the flag carrier airline of the United Kingdom, based in Waterside, near its main hub at London Heathrow Airport. British Airways is the largest airline in the UK based on fleet size, international flights and international destinations...
became involved as a potential customer for Bombardier’s Regional Jet
Bombardier CRJ200
The Bombardier CRJ100 and CRJ200 are a family of regional airliner manufactured by Bombardier, and based on the Canadair Challenger business jet.-Development:...
, which could not accommodate a full Cat 3 autoland system, but would be required to operate in those conditions. By working with Alaska Airlines and Boeing, British Airways technical pilots were able to demonstrate that a “Hybrid” concept was feasible, and although British Airways never eventually bought the Regional Jet, this was the breakthrough needed for international approval for such systems which meant that they could reach a global market.
The wheel turned full circle when in December 2006 London Heathrow
London Heathrow Airport
London Heathrow Airport or Heathrow , in the London Borough of Hillingdon, is the busiest airport in the United Kingdom and the third busiest airport in the world in terms of total passenger traffic, handling more international passengers than any other airport around the globe...
was affected for a long period by dense fog. This airport was operating at maximum capacity in good conditions, and the imposition of low visibility procedures required to protect the localiser signal for autoland systems meant a major reduction in capacity from approximately 60 to 30 landings per hour. Since most airlines operating into Heathrow already had autoland-equipped aircraft, and thus expected to operate as normal, massive delays occurred. The worst affected airline was of course British Airways, as the largest operator at the airport.
BLEU and the origins of Autoland
The Blind Landing Experimental Unit (BLEU) of the Royal Aircraft EstablishmentRoyal Aircraft Establishment
The Royal Aircraft Establishment , was a British research establishment, known by several different names during its history, that eventually came under the aegis of the UK Ministry of Defence , before finally losing its identity in mergers with other institutions.The first site was at Farnborough...
(RAE) was formed at RAF Woodbridge and RAF Martlesham Heath
RAF Martlesham Heath
RAF Martlesham Heath is a former Royal Air Force airfield in England. The field is located 1½ miles SW of Woodbridge, Suffolk.- RFC/RAF prewar use:Martlesham Heath was first used as a Royal Flying Corps airfield during World War I...
during 1945 and 1946. It was a multi-disciplinary unit, drawing staff from the RAE, Farnborough and the Telecommunications Research Establishment
Telecommunications Research Establishment
The Telecommunications Research Establishment was the main United Kingdom research and development organization for radio navigation, radar, infra-red detection for heat seeking missiles, and related work for the Royal Air Force during World War II and the years that followed. The name was...
, Malvern (TRE). The terms of reference were that the unit “will operate as a satellite of the RAE and will be responsible for the development on blind approach and landing of RAF, Naval and Civil aircraft”. Before the formation of BLEU, an automatic landing was made at the Telecommunications Flying Unit (TFU) of the TRE at RAF Defford
RAF Defford
RAF Defford was a Royal Air Force station in Worcestershire, England during the Second World War.Construction of RAF Defford was completed in 1941, and for a few months the airfield was used as a satellite station by the Wellington bombers of 23 Operational Training Unit , based a few miles away...
in a Boeing 247
Boeing 247
The Boeing Model 247 was an early United States airliner, considered the first such aircraft to fully incorporate advances such as all-metal semi-monocoque construction, a fully cantilevered wing and retractable landing gear...
D aircraft, DZ203
United Kingdom military aircraft serials
In the United Kingdom to identify individual aircraft, all military aircraft are allocated and display a unique serial number. A unified serial number system, maintained by the Air Ministry , and its successor the Ministry of Defence , is used for aircraft operated by the Royal Air Force , Fleet...
, early in 1945, using the American SCS 51 radio guidance system. That was in complete darkness, with no landing lights and all other lights obscured by the wartime blackout. There was no flare-out - the low approach speed and shallow glide angle meant that the aircraft could be allowed to fly straight onto the ground. SCS 51 was the basis for the Instrument Landing System (ILS), adopted by ICAO in 1948 .
There was an alternative system to the SCS 51 VHF USAF scheme from Col. Moseley and that was the radar-based system wholly devised, developed and trialled by F / O L. C. Barber B.Sc (Hons) and his colleagues at Defford. This system effectively gave range and height data bases which could be added to autopilot heading info and so enriched the control functions enabling automatic landing opportunities. The full technical description of this is now available in the archives at RAF Museum Hendon, reference X005-4863, and includes original photographic records of Boeing 247 DZ203.
Research during the first few years at BLEU led to the conclusion that a promising approach to blind landing would be a fully automatic system, and to the definition of the requirements for such a system, later designated Autoland. ILS was used as guidance during the approach phase, but at that time was not sufficiently accurate to complete the landing. That led to the development at BLEU of an improved FM radio altimeter for height guidance, capable of resolving height differences to 2 feet at low altitude, and a magnetic leader cable system for azimuth guidance. In collaboration with Smiths Industries Ltd.
Smiths Group
Smiths Group plc is a global engineering company headquartered in London, United Kingdom. It has operations in over 50 countries and employs around 23,550 staff....
, BLEU also developed coupling units to derive the commands to the autopilot from the guidance signals, and auto-throttle.
Components of the system were developed separately on several types of aircraft, including the Lancaster
Avro Lancaster
The Avro Lancaster is a British four-engined Second World War heavy bomber made initially by Avro for the Royal Air Force . It first saw active service in 1942, and together with the Handley Page Halifax it was one of the main heavy bombers of the RAF, the RCAF, and squadrons from other...
, Viking
Vickers VC.1 Viking
The Vickers VC.1 Viking was a British twin-engine short-range airliner derived from the Vickers Wellington bomber and built by Vickers Armstrongs Limited at Brooklands near Weybridge in Surrey. In the aftermath of the Second World War, the Viking was an important airliner with British airlines...
, Devon
De Havilland Dove
The de Havilland DH.104 Dove was a British monoplane short-haul airliner from de Havilland, the successor to the biplane de Havilland Dragon Rapide and was one of Britain's most successful post-war civil designs...
and the Albemarle
Armstrong Whitworth Albemarle
The Armstrong Whitworth A.W.41 Albemarle was a British twin-engine transport aircraft that entered service during the Second World War.Originally designed as a medium bomber that could be built by non-aviation companies without using light alloys, the Albemarle never served in that role, instead...
. A demonstration of the techniques used was given to military and government representatives in May 1949. By 1950 the entire system had been installed on a DH Devon and the first demonstration of Autoland was given on that aircraft on 3 July 1950. Over the next 20 years, BLEU in conjunction with UK industry and the UK airworthiness authority, was responsible for almost all of the pioneering work needed to convert the concept of those experimental demonstrations into safe, accurate blind landings by large transport aircraft. The system in use during the early 2000s is basically the same as that used experimentally in 1950. The following diagram, from J S Shayler’s 1958 memorandum, shows how the different components of the system, and guidance signals, were used during the consecutive phases of an automatic landing.
BLEU during the 1950s and 1960s
During the early 1950s, as a preliminary to the development of the full Autoland system, automatic approach trials were carried out on ValettaVickers Valetta
|-See also:-References:NotesBibliography* Andrews, C.F. and E.B. Morgan. Vickers Aircraft since 1908. London: Putnam, 1988. ISBN 0-85177-815-1....
, Meteor
Gloster Meteor
The Gloster Meteor was the first British jet fighter and the Allies' first operational jet. It first flew in 1943 and commenced operations on 27 July 1944 with 616 Squadron of the Royal Air Force...
and Canberra
English Electric Canberra
The English Electric Canberra is a first-generation jet-powered light bomber manufactured in large numbers through the 1950s. The Canberra could fly at a higher altitude than any other bomber through the 1950s and set a world altitude record of 70,310 ft in 1957...
aircraft. The Canberra, VN799, was acquired in 1953 but was a write-off following a crash landing in August that year due to a double engine failure, fortunately without serious injury to the crew.
At that time, Autoland had lower priority because efforts were concentrated on other projects including rapid landing of aircraft for RAF Fighter Command
RAF Fighter Command
RAF Fighter Command was one of three functional commands of the Royal Air Force. It was formed in 1936 to allow more specialised control of fighter aircraft. It served throughout the Second World War, gaining recognition in the Battle of Britain. The Command continued until 17 November 1943, when...
, visual aids for pilots, runway approach lighting and an approach aid using DME with Barbro. That changed when Operational Requirement 947 (OR947) for automatic landing on the V-Force
V bomber
The term V bomber was used for the Royal Air Force aircraft during the 1950s and 1960s that comprised the United Kingdom's strategic nuclear strike force known officially as the V-force or Bomber Command Main Force...
bomber fleet was issued in 1954. At that time the V-bomber force was the UK’s main contribution to the strategic nuclear power of the west and all-weather operation was essential. There was also renewed interest in automatic landing for civil aviation. As the next step in the development, the flare-out and coupling units from the Devon were linked to a Smiths Type D autopilot and installed in Varsity
Vickers Varsity
-See also:-References:NotesBibliography* Andrews, C.F. and E.B. Morgan. Vickers Aircraft since 1908. London: Putnam, 1988. ISBN 0-85177-815-1.* Ellis, Ken. Wrecks & Relics. Manchester, UK: Crecy Publishing, 21st edition, 2008. ISBN 9-780859-791342....
WF417, a much larger aircraft, capable of carrying 38 people rather than 10 in the Devon. The first fully automatic approach and landing was made by WF417 on 11 November 1954 under calm and misty conditions. A similar system was installed in Canberra WE189 to provide the first application of Autoland to jet-type aircraft. Automatic approaches and automatic landings were recorded by WE189 but the development was interrupted in April 1956 when the facilities at Woodbridge, which had the only suitable leader cable installation, ceased to be available to BLEU. Development of auto-flare and automatic kicking-off drift was continued at RAF Wittering
RAF Wittering
RAF Wittering is a Royal Air Force station within the unitary authority area of Peterborough, Cambridgeshire. Although Stamford in Lincolnshire is the nearest town, the runways of RAF Wittering cross the boundary between Cambridgeshire and Northamptonshire....
, but in September that year WE189, returning from tests at Wittering, crashed due to engine failure on an approach when returning to its base at Martlesham Heath. The pilot, Flt. Lt. Les Coe, and the BLEU scientist in charge of the project, Mr. Joe Birkle, were killed.
Early in 1957 BLEU moved from Martlesham Heath to a newly equipped airfield at Thurleigh
RAF Thurleigh
RAF Thurleigh was a Royal Air Force station located five miles north of Bedford, England. Thurleigh was transferred to the U.S. Eighth Air Force on 9 December 1942, designated Station 111, and used for heavy bomber operations against Nazi Germany.-Origins:...
, the base for RAE Bedford. The development was continued in a third Canberra, WJ992, based on the results obtained with WE189. Experimental flights in WJ992 began late in 1957, leading to automatic landings with auto-throttle in March 1958. The following notes are from the logbook of the BLEU technologist carrying out the development: 10 March 1958 (the 38th flight of that programme): “Very little drift, about 0.3g - heights 150-55-15-0”. That was with manual throttle, but auto throttle was used on 12 March, in a strong crosswind. March 17 saw “strong tailwind, 20 - 25 kt., pronounced float“ and on June 20, after adjustments during a further 20 flights: “not bad - about 0.7 g nicely on main wheels - kicking off drift OK“. Then on June 26: “Throttles off at 50ft. Very pleasing results” and on 20 August “hands and feet off”. Recordings of automatic landings in that aircraft started on 8 July 1958, flight no. 69. Results for automatic landings in Canberra aircraft were quoted by Wood in 1957 and published by Charnley in 1959, as for a “medium size jet aircraft”. By October 1958, BLEU had completed over 2,000 fully automatic landings, mainly in the Canberra and Varsity aircraft.
The V-bomber project to install and develop Autoland on Vulcan
Avro Vulcan
The Avro Vulcan, sometimes referred to as the Hawker Siddeley Vulcan, was a jet-powered delta wing strategic bomber, operated by the Royal Air Force from 1956 until 1984. Aircraft manufacturer A V Roe & Co designed the Vulcan in response to Specification B.35/46. Of the three V bombers produced,...
XA899, originally classified as Secret
Classified information
Classified information is sensitive information to which access is restricted by law or regulation to particular groups of persons. A formal security clearance is required to handle classified documents or access classified data. The clearance process requires a satisfactory background investigation...
, ran in parallel with the Canberra and Varsity work. The first automatic landings in the Vulcan were made between December 1959 and April 1960. Trials were carried out later that year and the system was accepted for military service in 1961.
It was recognised that leader cable would be impractical at some airports, but that it could be dispensed with if improvements could be made to ILS. Some improvement resulted from a narrow beam localizer aerial system developed by BLEU during the early 1950s and by 1958 automatic landings had been made using only ILS localiser for azimuth guidance. That required a good site but by the early 1960s radically new aerial designs for the ILS transmitters developed by Standard Telephones & Cables
Standard Telephones and Cables
Standard Telephones and Cables Ltd was a British telephone, telegraph, radio, telecommunications and related equipment R&D manufacturer. During its history STC invented and developed several groundbreaking new technologies including PCM and optical fibres.The company began life in London as...
(ST&C) improved ILS to an extent that leader cable could be dispensed with.
For many years there had been discussions between the UK Ministry of Aviation
Ministry of Aviation
Ministry of Aviation was a department of the United Kingdom government, established in 1959. Its responsibilities included the regulation of civil aviation and the supply of military aircraft, which it took on from the Ministry of Supply....
and the US Federal Aviation Agency
Federal Aviation Administration
The Federal Aviation Administration is the national aviation authority of the United States. An agency of the United States Department of Transportation, it has authority to regulate and oversee all aspects of civil aviation in the U.S...
(FAA) on guidance aids for landing in poor visibility. The Americans favoured a “pilot in the loop” technique, with improved aids for the pilot, over the fully automatic system preferred in the UK. In 1961, to gain experience with “the BLEU automatic landing system” the FAA sent a Douglas DC-7
Douglas DC-7
The Douglas DC-7 is an American transport aircraft built by the Douglas Aircraft Company from 1953 to 1958. It was the last major piston engine powered transport made by Douglas, coming just a few years before the advent of jet aircraft such as the Boeing 707 and Douglas DC-8.-Design and...
to RAE Bedford for the system to be installed and tested. After that and further tests on return to Atlantic City, the FAA were convinced and thereafter strongly supported a fully automatic solution to the all-weather problem which later was adopted internationally.
Up to that stage the Autoland system had been realised only as a “single-lane” or single channel system, without any redundancy to protect against equipment failure. During the late 1950s and early 1960s increased cooperation between BLEU, the UK Civil Aviation Authority (CAA) and companies in the aviation industry with BEA and BOAC
British Overseas Airways Corporation
The British Overseas Airways Corporation was the British state airline from 1939 until 1946 and the long-haul British state airline from 1946 to 1974. The company started life with a merger between Imperial Airways Ltd. and British Airways Ltd...
led to the definition of safety requirements in terms of a specification for maximum tolerable failure rates. In 1961, the UK Air Registration Board (ARB) of the CAA issued a working document BCAR 367 “Airworthiness Requirements for Autoflare and Automatic Landing” which formed the basis for the definitions for weather visibility categories adopted by ICAO in 1965. In 1959, contracts were placed by BEA and BOAC to develop automatic landing, based on Autoland, for the Trident and the VC10. The Trident used a triplex system with no common elements, so that a failure in one of the three channels could be detected and that channel eliminated. “Nuisance disconnects” were an early problem with that system, eventually solved by the industry, using torque switches with a controlled degree of lost motion. The introduction of Autoland for Category 3 operation in BEA’s Trident fleet required a huge effort by BEA, Hawker Siddeley Aviation, Smiths Industries and BLEU. A triplex system was also developed by Smiths and BLEU for the RAF’s Belfast
Short Belfast
The Short Belfast is a heavy lift turboprop freighter built by Short Brothers at Belfast. Only 10 were built for the British Royal Air Force with the designation Short Belfast C.1. When they were retired by the RAF, five went into civilian service with the cargo airline HeavyLift Cargo Airlines...
freighter.
The VC10 used an Elliott
Elliott Brothers (computer company)
-Elliott Brothers Ltd:Elliott Brothers Ltd was an early computer company of the 1950s–60s in the United Kingdom, tracing its descent from a firm of instrument makers founded by William Elliott in London around 1804. The research laboratories were based at Borehamwood, originally set up in...
duplicated monitored system. Later, the Concorde system was basically an improved version of the VC10 one, benefiting from advances in electronic circuit technology during the late 1960s. By 1980, the Trident had carried out more than 50,000 in-service automatic landings. The VC10 accrued 3,500 automatic landings before use of the system was curtailed in 1974 for economic reasons. By 1980, Concorde had performed nearly 1,500 automatic landings in passenger service.
BLEU (renamed the Operational Systems Division of RAE in 1974) continued to play a leading role in the development of aircraft guidance systems, using a variety of aircraft including DH Comet
De Havilland Comet
The de Havilland DH 106 Comet was the world's first commercial jet airliner to reach production. Developed and manufactured by de Havilland at the Hatfield, Hertfordshire, United Kingdom headquarters, it first flew in 1949 and was a landmark in aeronautical design...
, BAC 1-11
BAC One-Eleven
The British Aircraft Corporation One-Eleven, also known as the BAC-111, BAC-1-11 or BAC 1-11, was a British short-range jet airliner of the 1960s and 1970s...
, HS 748 (to replace the Varsities, which had been the main “work horses“ for BLEU experiments for more than a decade) and VC-10 until the closure of RAE Bedford in 1994.
Autoland systems
A typical autoland system consists of an ILS (integrated glideslope receiver, localizer receiver, and perhaps GPS receiver as well) radio to receive the localizer and glideslope signals. The output of this radio will be a "deviation" from center which is provided to the flight control computer; this computer which controls the aircraft control surfaces to maintain the aircraft centered on the localizer and glideslope. The flight control computer also controls the aircraft throttles to maintain the appropriate approach speed. At the appropriate height above the ground (as indicated by the radio altimeter) the flight control computer will retard the throttles and initiate a pitch-up maneuver. The purpose of this "flare" is to reduce the energy of the aircraft such that it "stops flying" and settles onto the runway.For CAT IIIc, the flight control computer will continue to accept deviations from the localizer and use the rudder to maintain the aircraft on the localizer (which is aligned with the runway centerline.) On landing the spoilers will deploy (these are surfaces on the top of the wing towards the trailing edge) which causes airflow over the wing to become turbulent, destroying lift. At the same time the autobrake system will apply the brakes and the thrust reversers will activate to maintain a deceleration profile. The anti-skid system will modulate brake pressure to keep all wheels turning. As the speed decreases, the rudder will lose effectiveness and the pilot will need to control the direction of the airplane using nose wheel steering, a system which typically is not connected to the flight control computer.
From an avionics safety perspective, a CAT IIIc landing is the "worst case scenario" for safety analysis because a failure of the automatic systems from flare through the roll-out could easily result in a "hard over" (where a control surface deflects fully in one direction.) This would happen so fast that the flight crew may not effectively respond. For this reason Autoland systems are designed to incorporate a high degree of redundancy so that a single failure of any part of the system can be tolerated (fail active) and a second failure can be detected – at which point the autoland system will turn itself off (uncouple, fail passive). One way of accomplishing this is to have “three of everything.” Three ILS receivers, three radio altimeters, three flight control computers, and three ways of controlling the flight surfaces. The three flight control computers all work in parallel and are in constant cross communications, comparing their inputs (ILS receivers and radio altimeters) with those of the other two flight control computers. If there is a difference in inputs, then a computer can “vote out” the deviant input and will notify the other computers that “RA1 is faulty.” If the outputs don’t match a computer can declare itself as faulty and, if possible, take itself off line.
When the pilot “arms” the system (prior to capture of either the localizer or glideslope) the flight control computers perform an extensive series of Built In Tests (BIT). For a CAT III landing, all the sensors and all the flight computers must be “in good health” before the pilot receives an AUTOLAND ARM (These are generic indications and will vary depending on equipment supplier and aircraft manufacturer) indication. If part of the system is in error, then an indication such as “APPROACH ONLY” would be presented to inform the flight crew that a CAT III landing is not possible. If the system is properly in the ARM mode, when the ILS receiver detects the localizer, then the autoland system mode will change to ‘LOCALIZER CAPTURE’ and the flight control computer will turn the aircraft into the localizer and fly along the localizer. A typical approach will have the aircraft come in “below the glideslope” (vertical guidance) so the airplane will fly along the localizer (aligned to the runway centerline) until the glideslope is detected at which point the autoland mode will change to CAT III and the aircraft will be flown by the flight control computer along the localizer and glideslope beams. The antennas for these systems are not at the runway touch down point however, with the localizer being some distance beyond the runway. However at a predefined distance above the ground the aircraft will initiate the flare maneuver, maintain the same heading, and settle onto the runway within the designated touch down zone.
If the autoland system loses redundancy prior to the decision height, then an AUTOLAND FAULT will be displayed to the flight crew at which point the crew can elect to continue as a CAT II approach or if this is not possible because of weather conditions, then the crew would need to initiate a go-around and proceed to an alternative airport.
If a single failure occurs below decision height AUTOLAND FAULT will be displayed, however at that point the aircraft is committed to landing and the autoland system will remain engaged, controlling the aircraft on only two systems until the pilot completes the rollout and brings the aircraft to a full stop on the runway or turns off the runway onto a taxiway. This is termed “fail active.” However in this state the autoland system is “one fault away” from disengaging so the AUTOLAND FAULT indication should inform the flight crew to monitor the system behavior very careful and be ready to take control immediately. The system is still fail active and is still performing all necessary cross checks so that if one of the flight control computers decides that the right thing to do is order a full deflection of a control surface, the other computer will detect that there is a difference in the commands and this will take both computers off line (fail passive) at which time the flight crew must immediately take control of the aircraft as the automatic systems have done the safe thing by taking themselves off line.
During system design, the predicted reliability numbers for the individual equipment which makes up the entire autoland system (sensors, computers, controls, and so forth) are combined and an overall probability of failure is calculated. As the “threat” exists primarily during the flare through roll-out, this “exposure time” is used and the overall failure probability must be less than one in a million.
Accidents
On February 23, 2009, a Turkish Airlines Boeing 737-800 (Turkish Airlines Flight 1951Turkish Airlines Flight 1951
Turkish Airlines Flight 1951 was a passenger flight which crashed during landing to Amsterdam Schiphol Airport, Netherlands, on 25 February 2009, killing nine passengers and crew including all three pilots....
) crashed about a mile (1500m) short of the runway at Amsterdam Schiphol Airport
Amsterdam Schiphol Airport
Amsterdam Airport Schiphol ) is the Netherlands' main international airport, located 20 minutes southwest of Amsterdam, in the municipality of Haarlemmermeer. The airport's official English name, Amsterdam Airport Schiphol, reflects the original Dutch word order...
. The Dutch Safety Board
Dutch Safety Board
The Dutch Safety Board; Onderzoeksraad Voor Veiligheid , is based in The Hague, The Netherlands. The first chairman was Pieter van Vollenhoven, who served until February of 2011...
published preliminary findings only one week after the crash, suggesting the autoland played a key role in downing the plane.
According to the Flight Data Recorder
Flight data recorder
A flight data recorder is an electronic device employed to record any instructions sent to any electronic systems on an aircraft. It is a device used to record specific aircraft performance parameters...
, the airplane was on a full autoland approach at a height of 1950 ft / 595 m the left Radio Altimeter
Radar altimeter
A radar altimeter, radio altimeter, low range radio altimeter or simply RA measures altitude above the terrain presently beneath an aircraft or spacecraft...
had been misreporting a height of -8 ft. The autoland system responded accordingly and configured the plane for touchdown, idling the engines. This made the plane lose speed and stall
Stall (flight)
In fluid dynamics, a stall is a reduction in the lift coefficient generated by a foil as angle of attack increases. This occurs when the critical angle of attack of the foil is exceeded...
. When the flight crew received stall-warnings, they were already too low and too slow to recover. As a secondary factor, the Safety Board suggested the crew did not have a visual ground reference because of foggy conditions.
At this point it is unclear how failure of one radio altimeter could cause a crash during an autoland approach. The autoland system has obviously been designed to be fail-safe and the airplane was equipped with more than one radio altimeter.
The final investigation report was released on 6 May 2010.
See also
- LAASLaas-Places:France:* Laas, Gers* Laas, Loiret* Laàs, in the Pyrénées-Atlantiques départementItaly:* Laas, South Tyrol, a municipality in South Tyrol-Acronym:* Laboratory for analysis and architecture of systems* Local Area Augmentation System...
- Instrument Landing System
- Head-Up DisplayHead-Up DisplayA head-up display or heads-up display is any transparent display that presents data without requiring users to look away from their usual viewpoints...
- FogFogFog is a collection of water droplets or ice crystals suspended in the air at or near the Earth's surface. While fog is a type of stratus cloud, the term "fog" is typically distinguished from the more generic term "cloud" in that fog is low-lying, and the moisture in the fog is often generated...
External links
- Trident Autolanding a 1969 FlightFlight InternationalFlight International is a global aerospace weekly publication produced in the UK. Founded in 1909, it is the world's oldest continuously published aviation news magazine...
article on the Hawker Siddeley TridentHawker Siddeley TridentThe Hawker Siddeley HS 121 Trident was a British short/medium-range three-engined jet airliner designed by de Havilland and built by Hawker Siddeley in the 1960s and 1970s...
's autoland system - Automatic Landing a 1969 Flight article on the differing philosophies regarding autoland requirements