9
$\begingroup$

The below explanation is what I've got from the internet about fail passive and fail operational:

Fail operational - Where you have 3 autopilots engaged, such that any single failure will result in the remaining 2 autopilots being able to safely land the aircraft. That is if there is a failure autoland remains operational.

Fail Passive - Where you have 2 autopilots engaged, such that a single autopilot failure will result in the disengagement of both autopilots with no significant deviation from the established flight path. In this case the pilot must manually take control and go-around/land. (avsim.com)

Can someone confirm whether the above explanation is correct?

I've read that the A320's Autoland is fail operational but that does not match with the above explanation (since the 320 only has 2 AP's hence making it fail passive).

And also (if possible) can someone give examples of aircraft whose Autoland is fail operational/passive?

$\endgroup$
1
  • $\begingroup$ As far as I know the A320 has two autopilots each of which has two lanes. So essentially it has four autopilots and not 3 or 2. One autopilot lane pair with two lanes is already fail passive. Engage the second pair of lanes (AP2) and you have dual fail passive systems. Now you can also monitor and compare the AP1 and AP2 signals of each lane... If one lane fails you immediately can vote it out, fail and keep operating (fail operational) If you only had two lanes you would never know which one was correct, so you disable both, fail passive. $\endgroup$
    – Jan
    Dec 8 '20 at 17:54
12
$\begingroup$

The quoted explanation about "fail operational" and "fail passive" is correct, in that "fail operational" means the system will continue to function after an failure, and "fail passive" means the system will not misbehave after an failure.

The exact number of autopilots required to make this work, however, is debatable; and much depends on how you define it.

Let's take the Boeing 777 because it is easy to begin with. It has three autopilots. It will say "LAND 3" or "LAND 2" respectively. In a system of three, a failure can be detected if one disagrees with the other two. In a system of two, it is uncertain which one has failed, so all units come offline.

Now here comes the interesting part: what if I can distinguish a failed unit from a functional unit, without using another functional unit? In other words, what if I have something that can monitor the existing units, but is incapable of functioning the same as one of the monitored units on its own?

That is how fail operational can be implemented with two autopilots. For example, the Flight Management and Guidance System (FMGS) on the Airbus A320 can switch from "Dual Mode" to "Single Mode". The FCOM does not detail how it does that. (A320 FCOM - Aircraft Systems - Auto Flight - General)

But the FCOM does state a "CAT 3 DUAL" automatic landing is fail operational

the remaining part of the automatic system allows the aircraft to complete the approach, flare and landing

while a "CAT 3 SINGLE" landing is fail passive:

there is no significant out-of-trim condition or deviation of flight path or attitude, bu the landing is not completed automatically

A320 FCOM - Procedures - Normal Procedures - Landing Categories

The Boeing 737 has 3 inertial sources but only 2 autopilots. It implements fail operational on the inertial sources but fail passive on the autopilots.

If a failure is detected, the flight controls respond to the A/P commanding the lesser control movement. If a failure occurs in one A/P, the failed channel is counteracted by the second channel such that both A/Ps disconnect with minimal airplane maneuvering and with aural and visual warnings to the pilot.

Boeing 737 FCOM volume 2 - Automatic Flight - System Description

$\endgroup$
6
  • $\begingroup$ Is the A320 autoland fail operational/fail passive? $\endgroup$
    – Johnson
    Jan 13 '20 at 17:09
  • $\begingroup$ Ok, no prob. Because if the A320 is fail passive, the above explanation would make more sense. $\endgroup$
    – Johnson
    Jan 13 '20 at 17:11
  • $\begingroup$ @Bianfable but then how do you know which one has failed? It works because in a system of three, you can kick the one that disagrees with the other two. In a system of two, you don't know which one is good, so you must kick both of them. $\endgroup$
    – kevin
    Jan 13 '20 at 17:20
  • $\begingroup$ @Bianfable I just pulled out the B737 manual for reference. On LAND 3 it has two autopilots but three inertial sources. The manual also describes LAND 3 as fail-operational and LAND 2 as fail-passive. The relevant chapter is "Automatic Flight" in FCOM v2. $\endgroup$
    – kevin
    Jan 13 '20 at 17:27
  • $\begingroup$ @kevin Each autopilot should have a monitoring channel. If the monitoring channel disagrees with the command channel, it's considered failed. $\endgroup$
    – JZYL
    Jan 13 '20 at 17:31
5
$\begingroup$

Definitions provided by the FAA can be found in AC 120-28D - Criteria for Approval of Category III Weather Minima for Takeoff, Landing, and Rollout. From the document we find for Fail Operational:

4.3.2. Fail Operational Category III Operations. A Fail Operational System is a system which after failure of any single component, is capable of completing an approach, flare and touchdown, or approach, flare, touchdown and rollout by using the remaining operating elements of the Fail Operational system. The failure effects of single components of the system, airplane or equipment external to the airplane which could have an effect on touchdown or rollout performance must be considered when evaluating Fail Operational systems.

With the following examples:

The following are typical arrangements which may be acceptable for Fail Operational Systems:

  1. Two or more monitored fail passive autopilots or integrated autopilot flight director systems each with dual channels making up an automatic fail operational system designed so that at least one autoflight system remains operative after the failure of one system, and the failed system is not used or cannot cause unacceptable autoflight system performance.
    Note: Following a failure with this configuration, it is not intended that a landing be continued with flight director alone, unless a successful Proof of Concept demonstration has been completed.
  2. Three autopilots or integrated autopilot flight director systems designed so that at least two remain operative after failure to permit comparison and provide necessary monitoring and protection while continuing to a landing.
  3. A monitored fail passive automatic flight control system with automatic landing capability to touchdown and rollout, if applicable, plus an independent and adequately failure protected manual flight guidance system, suitable for landing and rollout with guidance provided for the flying pilot and monitoring displays for the non-flying pilot. A proof of concept demonstration would be necessary for this arrangement.
  4. Two independent and adequately monitored manual flight guidance systems with independent displays for the pilot flying and the pilot not flying, each capable of supporting a landing and rollout. A proof of concept demonstration would be necessary for this arrangement.

The key to fail operational is the ability to continue the operation after a single fault. It's about the capability, not the solution that provides the capability.

And for Fail Passive:

4.3.4. Fail Passive Category III Operations. A Fail Passive System is a system which in the event of a failure, causes no significant deviation of aircraft flight path or attitude. The capability to continue the operation may be lost and an alternate course of action (e.g., a missed approach) may be required.

With the following examples:

Typical arrangements which may be used to meet the requirements for Category III fail passive operations using a 50 ft. Decision Height include the following:

  1. A single monitored automatic flight control system with automatic landing capability.
  2. A fail operational automatic flight control system with automatic landing which has reverted to a Fail Passive configuration or has been dispatched in a fail-passive configuration.
  3. A monitored flight guidance system (e.g., HUD) designed for manual control by the pilot flying, and for monitoring by the pilot not flying. Aircraft intended for Fail Passive Category III operations should have aircraft systems which meet the criteria specified in Appendix 3. Aircraft previously demonstrated to meet earlier Fail Passive criteria may continue to operate using Category III minima in accordance with approved operation specifications.

The key to Fail Passive is that it causes no hazard even though you may not be able to continue the approach.

$\endgroup$
2
$\begingroup$

I don't think the quote you gave is correct. This might be the case for some aircraft (like the Boeing 777 with 3 autopilots), but not in general. A more general definition is:

Autoland systems are normally designated Fail Operational or Fail Passive.

  • A Fail Operational system must have at least two autopilots engaged for the approach. The failure of one autopilot will still allow an autoland to be carried out. This allows a “no decision height” approach to be conducted.

  • A Fail Passive system is normally associated with a single autopilot approach. In this case, failure of the autopilot will not result in any immediate deviation from the desired flight path; however, the pilot flying must immediately assume control of the aircraft and, unless he has sufficient visual reference to land, carry out a missed approach. The lowest allowable decision altitude (DA) for a fail passive system is normally 50’.

(SKYbrary - Autoland - System Safety)

So 2 autpilots are enough for a Fail Operational system. I cannot say about the A320 specifically, but the Boeing 737 has a fail operational autoland mode with just 2 autopilots:

Fail-Operational Autoland Status Annunciations

The following annunciations provide the flight crew with autoland system mode and status:

  • LAND 3 – two autopilots, three inertial sources, and the associated sensors are operating normally for an automatic landing and rollout.
  • LAND 2 – a failure has occurred above Alert Height and redundancy is reduced; but the autoland system is still capable of making an automatic landing and rollout.
  • NO AUTOLAND – the system is unable to make an automatic landing.

With a LAND 3 (fail-operational) indication, the autoland system level of redundancy is such that a single fault cannot prevent the autopilot system from making an automatic landing.

With a LAND 2 (fail passive) indication, the level of redundancy is such that a single fault cannot cause a significant deviation from the flight path.

(Boeing 737 NG FCOM v2 - Automatic Flight - System Description)

$\endgroup$
1
$\begingroup$

Let us look at the statements and see how right or wrong they are.

Statement 1:

Fail operational - Where you have 3 autopilots engaged, such that any single failure will result in the remaining 2 autopilots being able to safely land the aircraft. That is if there is a failure autoland remains operational.

First of all, this statement is not wrong. It is as a matter of correct. Yes, if an aircraft has 3 autopilots, it will remain fail operational if one of them malfunctions during an automatic landing. But you do not need 3 autopilots to achieve fail operational capability. If you want to have fail operational capability with two autopilots, you need two fully independent auto pilot performance monitoring systems. All Airbus aircraft starting from the A320 have two autopilots and they all have fail operational automatic landing systems.

Statement 2:

Fail Passive - Where you have 2 autopilots engaged, such that a single autopilot failure will result in the disengagement of both autopilots with no significant deviation from the established flight path. In this case the pilot must manually take control and go-around/land.

This statement is wrong. With two autopilots engaged, if a single autopilot were to fail, the system becomes fail passive. It is not necessary for the other autopilot to disengage. And in some certain cases, the aircraft can even perform an automatic landing with a single autopilot (in this case it remains fail operational). I will explain how it works later on.

Here are the JAA (current EASA) definitions of both the fail operational and fail passive.

FAIL OPERATIONAL

An automatic landing system is fail-operational if, in the event of a failure below alert height, the approach, the flare and landing can be completed by the remaining part of the automatic system. In the event of failure, the automatic landing system will operate as a fail-passive system.

FAIL PASSIVE

An automatic landing system is fail-passive if, in the event of a failure, there is no significant out-of-trim condition or deviation of flight path or attitude but the landing is not completed automatically. For a fail-passive automatic landing system the pilot assumes control of the aircraft after a failure.

If we look at the definition for fail operational, you can see that it does not say anything about 3 autopilots. But it says something about an alert height. It says below alert height, a system is fail operational if after a failure in the automatic system, an aircraft is still able to perform an automatic landing with the remaining part of the automatics system. So, what is this alert height?

According to the Airbus A320 FCTM:

ALERT HEIGHT

The Alert Height (AH) is the height above the runway, based on the characteristics of the aeroplane and its fail-operational automatic landing system, above which a CATIII approach would be discontinued and a missed approach initiated if a failure occurred in one of the redundant parts of the automatic landing system, or in the relevant ground equipment.

Alert height is an altitude derived by the aircraft manufacturer during aircraft certification (AH for A320 is 100ft).It is the minimum height at or below which an aircraft is allowed to perform an automatic landing after a failure in its redundant automatic systems. So, for example in an A320, if you were doing an automatic landing with both autopilots engaged and if one of the autopilots fail above the alert height which is 100ft, you will immediately commence a go around.

So, what if one of the autopilots fails below 100ft? The answer for this is it depends. Remember us talking of an autopilot performance monitoring system? In the A320, there is an AUTOLAND warning light on the glare shield of each pilot. This light flickers below 200ft if following conditions are encountered:

  • Both APs trip off
  • Excessive beam deviation is sensed
  • Localizer or glide slope transmitter or receiver fails
  • RA discrepancy of at least 15 ft is sensed.

The warning light is triggered by the monitoring system, if it detects any of the failures above. So, when below AH, the automatic landing can be continued even if one of the autopilots trip off as long as the AUTOLAND light does not come on. If the AUTOLAND light comes on, you should immediately go around.

enter image description here

Here is a little GIF of the AUTOLAND warning light test of A320 done by me. You can test if it works just by pressing it any time you like (even in flight). If you press it, the light comes on and it goes.

$\endgroup$
10
  • $\begingroup$ The second statement is correct and not incorrect. You have two autopilots and you compare the outputs to each other. If one autopilot deviates from the other you know one of them is faulty and the other is correct. But you cannot tell which one. Therefor you disable both of them and that leaves you with no autopilots. $\endgroup$
    – Jan
    Dec 8 '20 at 17:49
  • $\begingroup$ The A320 has two autopilots with each two lanes as far as I know. That means it essentially has two fail passive autopilots, or four autopilots in total. The first two lanes monitor each other and the second two lanes monitor each other. When one autopilot detects that their two lanes tell different stories it disengages, leaving you with one pair of lanes remaining. This is fail operational. $\endgroup$
    – Jan
    Dec 8 '20 at 17:51
  • 1
    $\begingroup$ @Jan The statement is incorrect because it says, if there is a fault in an autopilot, both the autopilots disengage. It is not that way. If one fails the other takes over and the system becomes fail passive. Even when we do normal approaches it is normal procedure to turn on both auto pilots, so that if one fails, the other immediately takes over. In that case the FMA changes from CAT 3 DUAL to CAT 3 SINGLE. $\endgroup$
    – Anas Maaz
    Dec 8 '20 at 17:57
  • $\begingroup$ What I'm saying is that the A320 does not have two autopilots, it has four. So after you loose one pair of autopilot lanes (both engages with a single push button and operating as as single unit) or if you don't turn it on, you still have two computer lanes monitoring each other. Only then you can apply the statement of fail passive. $\endgroup$
    – Jan
    Dec 8 '20 at 17:59
  • 1
    $\begingroup$ @jan Yes. One is the control the other is the monitor. The data needs to be the same for both the channels or within a certain threshold. If not the AP will be disconnected. $\endgroup$
    – Anas Maaz
    Dec 8 '20 at 19:28
0
$\begingroup$

Fail operational is a description for an automatic landing autoflight system before any autopilot (AP) fails and is divided into two categories:

  1. Three APs in the aircraft.
  2. Two APs + comparison circuitry (this circuitry can be considered more or less roughly as a third AP).
  • If one AP fails in either category above (the system now is a fail passive), there is no loss of control but the pilot cannot initiate an autoland because the system is fail passive now.
  • If a pilot initiated an autoland with every thing operating (fail operational) and then an AP fails the remaining AP (two or one depends on category) will continue to autoland normally.
  • If we are already in an autoland stage with a loss of a AP (two remaining or one remains operating depends which category) and then a second AP pilot fails pilot immediately takes control.
  • In any phase of flight if a single AP fails the system changes from fail operational to fail passive regardless how many APs remaining operating.
  • A pilot cannot initiate (start) an autoland from a fail passive system.
  • So 2 APs remaining operating in a 3 APs category is a fail passive, similarly if one AP remains operating in a 2 APs category is also a fail passive system.

ALI ALSALEEM - Ground instructor / Mideast Aviation Academy MEA - Jordan

$\endgroup$

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.