What does it mean when autoland is fail passive / fail operational?

Question

The below explanation is what I've got from the internet about fail passive and fail operational:

Fail operational - Where you have 3 autopilots engaged, such that any single failure will result in the remaining 2 autopilots being able to safely land the aircraft. That is if there is a failure autoland remains operational.

Fail Passive - Where you have 2 autopilots engaged, such that a single autopilot failure will result in the disengagement of both autopilots with no significant deviation from the established flight path. In this case the pilot must manually take control and go-around/land. (avsim.com)

Can someone confirm whether the above explanation is correct?

I've read that the A320's Autoland is fail operational but that does not match with the above explanation (since the 320 only has 2 AP's hence making it fail passive).

And also (if possible) can someone give examples of aircraft whose Autoland is fail operational/passive?

Answer 1

The quoted explanation about "fail operational" and "fail passive" is correct, in that "fail operational" means the system will continue to function after an failure, and "fail passive" means the system will not misbehave after an failure.

The exact number of autopilots required to make this work, however, is debatable; and much depends on how you define it.

Let's take the Boeing 777 because it is easy to begin with. It has three autopilots. It will say "LAND 3" or "LAND 2" respectively. In a system of three, a failure can be detected if one disagrees with the other two. In a system of two, it is uncertain which one has failed, so all units come offline.

Now here comes the interesting part: what if I can distinguish a failed unit from a functional unit, without using another functional unit? In other words, what if I have something that can monitor the existing units, but is incapable of functioning the same as one of the monitored units on its own?

That is how fail operational can be implemented with two autopilots. For example, the Flight Management and Guidance System (FMGS) on the Airbus A320 can switch from "Dual Mode" to "Single Mode". The FCOM does not detail how it does that. _{(A320 FCOM - Aircraft Systems - Auto Flight - General)}

But the FCOM does state a "CAT 3 DUAL" automatic landing is fail operational

the remaining part of the automatic system allows the aircraft to complete the approach, flare and landing

while a "CAT 3 SINGLE" landing is fail passive:

there is no significant out-of-trim condition or deviation of flight path or attitude, bu the landing is not completed automatically

_{A320 FCOM - Procedures - Normal Procedures - Landing Categories}

The Boeing 737 has 3 inertial sources but only 2 autopilots. It implements fail operational on the inertial sources but fail passive on the autopilots.

If a failure is detected, the flight controls respond to the A/P commanding the lesser control movement. If a failure occurs in one A/P, the failed channel is counteracted by the second channel such that both A/Ps disconnect with minimal airplane maneuvering and with aural and visual warnings to the pilot.

_{Boeing 737 FCOM volume 2 - Automatic Flight - System Description}

Answer 2

Definitions provided by the FAA can be found in AC 120-28D - Criteria for Approval of Category III Weather Minima for Takeoff, Landing, and Rollout. From the document we find for Fail Operational:

4.3.2. Fail Operational Category III Operations. A Fail Operational System is a system which after failure of any single component, is capable of completing an approach, flare and touchdown, or approach, flare, touchdown and rollout by using the remaining operating elements of the Fail Operational system. The failure effects of single components of the system, airplane or equipment external to the airplane which could have an effect on touchdown or rollout performance must be considered when evaluating Fail Operational systems.

With the following examples:

The following are typical arrangements which may be acceptable for Fail Operational Systems:

1. Two or more monitored fail passive autopilots or integrated autopilot flight director systems each with dual channels making up an automatic fail operational system designed so that at least one autoflight system remains operative after the failure of one system, and the failed system is not used or cannot cause unacceptable autoflight system performance.
   Note: Following a failure with this configuration, it is not intended that a landing be continued with flight director alone, unless a successful Proof of Concept demonstration has been completed.
2. Three autopilots or integrated autopilot flight director systems designed so that at least two remain operative after failure to permit comparison and provide necessary monitoring and protection while continuing to a landing.
3. A monitored fail passive automatic flight control system with automatic landing capability to touchdown and rollout, if applicable, plus an independent and adequately failure protected manual flight guidance system, suitable for landing and rollout with guidance provided for the flying pilot and monitoring displays for the non-flying pilot. A proof of concept demonstration would be necessary for this arrangement.
4. Two independent and adequately monitored manual flight guidance systems with independent displays for the pilot flying and the pilot not flying, each capable of supporting a landing and rollout. A proof of concept demonstration would be necessary for this arrangement.

The key to fail operational is the ability to continue the operation after a single fault. It's about the capability, not the solution that provides the capability.

And for Fail Passive:

4.3.4. Fail Passive Category III Operations. A Fail Passive System is a system which in the event of a failure, causes no significant deviation of aircraft flight path or attitude. The capability to continue the operation may be lost and an alternate course of action (e.g., a missed approach) may be required.

With the following examples:

Typical arrangements which may be used to meet the requirements for Category III fail passive operations using a 50 ft. Decision Height include the following:

1. A single monitored automatic flight control system with automatic landing capability.
2. A fail operational automatic flight control system with automatic landing which has reverted to a Fail Passive configuration or has been dispatched in a fail-passive configuration.
3. A monitored flight guidance system (e.g., HUD) designed for manual control by the pilot flying, and for monitoring by the pilot not flying. Aircraft intended for Fail Passive Category III operations should have aircraft systems which meet the criteria specified in Appendix 3. Aircraft previously demonstrated to meet earlier Fail Passive criteria may continue to operate using Category III minima in accordance with approved operation specifications.

The key to Fail Passive is that it causes no hazard even though you may not be able to continue the approach.

Answer 3

I don't think the quote you gave is correct. This might be the case for some aircraft (like the Boeing 777 with 3 autopilots), but not in general. A more general definition is:

Autoland systems are normally designated Fail Operational or Fail Passive.

• A Fail Operational system must have at least two autopilots engaged for the approach. The failure of one autopilot will still allow an autoland to be carried out. This allows a “no decision height” approach to be conducted.

• A Fail Passive system is normally associated with a single autopilot approach. In this case, failure of the autopilot will not result in any immediate deviation from the desired flight path; however, the pilot flying must immediately assume control of the aircraft and, unless he has sufficient visual reference to land, carry out a missed approach. The lowest allowable decision altitude (DA) for a fail passive system is normally 50’.

^{(SKYbrary - Autoland - System Safety)}

So 2 autpilots are enough for a Fail Operational system. I cannot say about the A320 specifically, but the Boeing 737 has a fail operational autoland mode with just 2 autopilots:

Fail-Operational Autoland Status Annunciations

The following annunciations provide the flight crew with autoland system mode and status:

• LAND 3 – two autopilots, three inertial sources, and the associated sensors are operating normally for an automatic landing and rollout.
• LAND 2 – a failure has occurred above Alert Height and redundancy is reduced; but the autoland system is still capable of making an automatic landing and rollout.
• NO AUTOLAND – the system is unable to make an automatic landing.

With a LAND 3 (fail-operational) indication, the autoland system level of redundancy is such that a single fault cannot prevent the autopilot system from making an automatic landing.

With a LAND 2 (fail passive) indication, the level of redundancy is such that a single fault cannot cause a significant deviation from the flight path.

^{(Boeing 737 NG FCOM v2 - Automatic Flight - System Description)}

Answer 4

Let us look at the statements and see how right or wrong they are.

Statement 1:

Fail operational - Where you have 3 autopilots engaged, such that any single failure will result in the remaining 2 autopilots being able to safely land the aircraft. That is if there is a failure autoland remains operational.

First of all, this statement is not wrong. It is as a matter of correct. Yes, if an aircraft has 3 autopilots, it will remain fail operational if one of them malfunctions during an automatic landing. But you do not need 3 autopilots to achieve fail operational capability. If you want to have fail operational capability with two autopilots, you need two fully independent auto pilot performance monitoring systems. All Airbus aircraft starting from the A320 have two autopilots and they all have fail operational automatic landing systems.

Statement 2:

Fail Passive - Where you have 2 autopilots engaged, such that a single autopilot failure will result in the disengagement of both autopilots with no significant deviation from the established flight path. In this case the pilot must manually take control and go-around/land.

This statement is wrong. With two autopilots engaged, if a single autopilot were to fail, the system becomes fail passive. It is not necessary for the other autopilot to disengage. And in some certain cases, the aircraft can even perform an automatic landing with a single autopilot (in this case it remains fail operational). I will explain how it works later on.

Here are the JAA (current EASA) definitions of both the fail operational and fail passive.

FAIL OPERATIONAL

An automatic landing system is fail-operational if, in the event of a failure below alert height, the approach, the flare and landing can be completed by the remaining part of the automatic system. In the event of failure, the automatic landing system will operate as a fail-passive system.

FAIL PASSIVE

An automatic landing system is fail-passive if, in the event of a failure, there is no significant out-of-trim condition or deviation of flight path or attitude but the landing is not completed automatically. For a fail-passive automatic landing system the pilot assumes control of the aircraft after a failure.

If we look at the definition for fail operational, you can see that it does not say anything about 3 autopilots. But it says something about an alert height. It says below alert height, a system is fail operational if after a failure in the automatic system, an aircraft is still able to perform an automatic landing with the remaining part of the automatics system. So, what is this alert height?

According to the Airbus A320 FCTM:

ALERT HEIGHT

The Alert Height (AH) is the height above the runway, based on the characteristics of the aeroplane and its fail-operational automatic landing system, above which a CATIII approach would be discontinued and a missed approach initiated if a failure occurred in one of the redundant parts of the automatic landing system, or in the relevant ground equipment.

Alert height is an altitude derived by the aircraft manufacturer during aircraft certification (AH for A320 is 100ft).It is the minimum height at or below which an aircraft is allowed to perform an automatic landing after a failure in its redundant automatic systems. So, for example in an A320, if you were doing an automatic landing with both autopilots engaged and if one of the autopilots fail above the alert height which is 100ft, you will immediately commence a go around.

So, what if one of the autopilots fails below 100ft? The answer for this is it depends. Remember us talking of an autopilot performance monitoring system? In the A320, there is an AUTOLAND warning light on the glare shield of each pilot. This light flickers below 200ft if following conditions are encountered:

• Both APs trip off
• Excessive beam deviation is sensed
• Localizer or glide slope transmitter or receiver fails
• RA discrepancy of at least 15 ft is sensed.

The warning light is triggered by the monitoring system, if it detects any of the failures above. So, when below AH, the automatic landing can be continued even if one of the autopilots trip off as long as the AUTOLAND light does not come on. If the AUTOLAND light comes on, you should immediately go around.

Here is a little GIF of the AUTOLAND warning light test of A320 done by me. You can test if it works just by pressing it any time you like (even in flight). If you press it, the light comes on and it goes.

Answer 5

Fail operational is a description for an automatic landing autoflight system before any autopilot (AP) fails and is divided into two categories:

1. Three APs in the aircraft.
2. Two APs + comparison circuitry (this circuitry can be considered more or less roughly as a third AP).

• If one AP fails in either category above (the system now is a fail passive), there is no loss of control but the pilot cannot initiate an autoland because the system is fail passive now.
• If a pilot initiated an autoland with every thing operating (fail operational) and then an AP fails the remaining AP (two or one depends on category) will continue to autoland normally.
• If we are already in an autoland stage with a loss of a AP (two remaining or one remains operating depends which category) and then a second AP pilot fails pilot immediately takes control.
• In any phase of flight if a single AP fails the system changes from fail operational to fail passive regardless how many APs remaining operating.
• A pilot cannot initiate (start) an autoland from a fail passive system.
• So 2 APs remaining operating in a 3 APs category is a fail passive, similarly if one AP remains operating in a 2 APs category is also a fail passive system.

ALI ALSALEEM - Ground instructor / Mideast Aviation Academy MEA - Jordan