The below explanation is what I've got from the internet about fail passive and fail operational:

Fail operational - Where you have 3 autopilots engaged, such that any single failure will result in the remaining 2 autopilots being able to safely land the aircraft. That is if there is a failure autoland remains operational.

Fail Passive - Where you have 2 autopilots engaged, such that a single autopilot failure will result in the disengagement of both autopilots with no significant deviation from the established flight path. In this case the pilot must manually take control and go-around/land. (avsim.com)

Can someone confirm whether the above explanation is correct?

I've read that the A320's Autoland is fail operational but that does not match with the above explanation (since the 320 only has 2 AP's hence making it fail passive).

And also (if possible) can someone give examples of aircraft whose Autoland is fail operational/passive?


The quoted explanation about "fail operational" and "fail passive" is correct, in that "fail operational" means the system will continue to function after an failure, and "fail passive" means the system will not misbehave after an failure.

The exact number of autopilots required to make this work, however, is debatable; and much depends on how you define it.

Let's take the Boeing 777 because it is easy to begin with. It has three autopilots. It will say "LAND 3" or "LAND 2" respectively. In a system of three, a failure can be detected if one disagrees with the other two. In a system of two, it is uncertain which one has failed, so all units come offline.

Now here comes the interesting part: what if I can distinguish a failed unit from a functional unit, without using another functional unit? In other words, what if I have something that can monitor the existing units, but is incapable of functioning the same as one of the monitored units on its own?

That is how fail operational can be implemented with two autopilots. For example, the Flight Management and Guidance System (FMGS) on the Airbus A320 can switch from "Dual Mode" to "Single Mode". The FCOM does not detail how it does that. (A320 FCOM - Aircraft Systems - Auto Flight - General)

But the FCOM does state a "CAT 3 DUAL" automatic landing is fail operational

the remaining part of the automatic system allows the aircraft to complete the approach, flare and landing

while a "CAT 3 SINGLE" landing is fail passive:

there is no significant out-of-trim condition or deviation of flight path or attitude, bu the landing is not completed automatically

A320 FCOM - Procedures - Normal Procedures - Landing Categories

The Boeing 737 has 3 inertial sources but only 2 autopilots. It implements fail operational on the inertial sources but fail passive on the autopilots.

If a failure is detected, the flight controls respond to the A/P commanding the lesser control movement. If a failure occurs in one A/P, the failed channel is counteracted by the second channel such that both A/Ps disconnect with minimal airplane maneuvering and with aural and visual warnings to the pilot.

Boeing 737 FCOM volume 2 - Automatic Flight - System Description

| improve this answer | |
  • $\begingroup$ Is the A320 autoland fail operational/fail passive? $\endgroup$ – Johnson Jan 13 at 17:09
  • $\begingroup$ Ok, no prob. Because if the A320 is fail passive, the above explanation would make more sense. $\endgroup$ – Johnson Jan 13 at 17:11
  • $\begingroup$ @Bianfable but then how do you know which one has failed? It works because in a system of three, you can kick the one that disagrees with the other two. In a system of two, you don't know which one is good, so you must kick both of them. $\endgroup$ – kevin Jan 13 at 17:20
  • $\begingroup$ @Bianfable I just pulled out the B737 manual for reference. On LAND 3 it has two autopilots but three inertial sources. The manual also describes LAND 3 as fail-operational and LAND 2 as fail-passive. The relevant chapter is "Automatic Flight" in FCOM v2. $\endgroup$ – kevin Jan 13 at 17:27
  • $\begingroup$ @kevin Each autopilot should have a monitoring channel. If the monitoring channel disagrees with the command channel, it's considered failed. $\endgroup$ – JZYL Jan 13 at 17:31

Definitions provided by the FAA can be found in AC 120-28D - Criteria for Approval of Category III Weather Minima for Takeoff, Landing, and Rollout. From the document we find for Fail Operational:

4.3.2. Fail Operational Category III Operations. A Fail Operational System is a system which after failure of any single component, is capable of completing an approach, flare and touchdown, or approach, flare, touchdown and rollout by using the remaining operating elements of the Fail Operational system. The failure effects of single components of the system, airplane or equipment external to the airplane which could have an effect on touchdown or rollout performance must be considered when evaluating Fail Operational systems.

With the following examples:

The following are typical arrangements which may be acceptable for Fail Operational Systems:

  1. Two or more monitored fail passive autopilots or integrated autopilot flight director systems each with dual channels making up an automatic fail operational system designed so that at least one autoflight system remains operative after the failure of one system, and the failed system is not used or cannot cause unacceptable autoflight system performance.
    Note: Following a failure with this configuration, it is not intended that a landing be continued with flight director alone, unless a successful Proof of Concept demonstration has been completed.
  2. Three autopilots or integrated autopilot flight director systems designed so that at least two remain operative after failure to permit comparison and provide necessary monitoring and protection while continuing to a landing.
  3. A monitored fail passive automatic flight control system with automatic landing capability to touchdown and rollout, if applicable, plus an independent and adequately failure protected manual flight guidance system, suitable for landing and rollout with guidance provided for the flying pilot and monitoring displays for the non-flying pilot. A proof of concept demonstration would be necessary for this arrangement.
  4. Two independent and adequately monitored manual flight guidance systems with independent displays for the pilot flying and the pilot not flying, each capable of supporting a landing and rollout. A proof of concept demonstration would be necessary for this arrangement.

The key to fail operational is the ability to continue the operation after a single fault. It's about the capability, not the solution that provides the capability.

And for Fail Passive:

4.3.4. Fail Passive Category III Operations. A Fail Passive System is a system which in the event of a failure, causes no significant deviation of aircraft flight path or attitude. The capability to continue the operation may be lost and an alternate course of action (e.g., a missed approach) may be required.

With the following examples:

Typical arrangements which may be used to meet the requirements for Category III fail passive operations using a 50 ft. Decision Height include the following:

  1. A single monitored automatic flight control system with automatic landing capability.
  2. A fail operational automatic flight control system with automatic landing which has reverted to a Fail Passive configuration or has been dispatched in a fail-passive configuration.
  3. A monitored flight guidance system (e.g., HUD) designed for manual control by the pilot flying, and for monitoring by the pilot not flying. Aircraft intended for Fail Passive Category III operations should have aircraft systems which meet the criteria specified in Appendix 3. Aircraft previously demonstrated to meet earlier Fail Passive criteria may continue to operate using Category III minima in accordance with approved operation specifications.

The key to Fail Passive is that it causes no hazard even though you may not be able to continue the approach.

| improve this answer | |

I don't think the quote you gave is correct. This might be the case for some aircraft (like the Boeing 777 with 3 autopilots), but not in general. A more general definition is:

Autoland systems are normally designated Fail Operational or Fail Passive.

  • A Fail Operational system must have at least two autopilots engaged for the approach. The failure of one autopilot will still allow an autoland to be carried out. This allows a “no decision height” approach to be conducted.

  • A Fail Passive system is normally associated with a single autopilot approach. In this case, failure of the autopilot will not result in any immediate deviation from the desired flight path; however, the pilot flying must immediately assume control of the aircraft and, unless he has sufficient visual reference to land, carry out a missed approach. The lowest allowable decision altitude (DA) for a fail passive system is normally 50’.

(SKYbrary - Autoland - System Safety)

So 2 autpilots are enough for a Fail Operational system. I cannot say about the A320 specifically, but the Boeing 737 has a fail operational autoland mode with just 2 autopilots:

Fail-Operational Autoland Status Annunciations

The following annunciations provide the flight crew with autoland system mode and status:

  • LAND 3 – two autopilots, three inertial sources, and the associated sensors are operating normally for an automatic landing and rollout.
  • LAND 2 – a failure has occurred above Alert Height and redundancy is reduced; but the autoland system is still capable of making an automatic landing and rollout.
  • NO AUTOLAND – the system is unable to make an automatic landing.

With a LAND 3 (fail-operational) indication, the autoland system level of redundancy is such that a single fault cannot prevent the autopilot system from making an automatic landing.

With a LAND 2 (fail passive) indication, the level of redundancy is such that a single fault cannot cause a significant deviation from the flight path.

(Boeing 737 NG FCOM v2 - Automatic Flight - System Description)

| improve this answer | |

Fail operational is a description for an automatic landing autoflight system before any autopilot (AP) fails and is divided into two categories:

  1. Three APs in the aircraft.
  2. Two APs + comparison circuitry (this circuitry can be considered more or less roughly as a third AP).
  • If one AP fails in either category above (the system now is a fail passive), there is no loss of control but the pilot cannot initiate an autoland because the system is fail passive now.
  • If a pilot initiated an autoland with every thing operating (fail operational) and then an AP fails the remaining AP (two or one depends on category) will continue to autoland normally.
  • If we are already in an autoland stage with a loss of a AP (two remaining or one remains operating depends which category) and then a second AP pilot fails pilot immediately takes control.
  • In any phase of flight if a single AP fails the system changes from fail operational to fail passive regardless how many APs remaining operating.
  • A pilot cannot initiate (start) an autoland from a fail passive system.
  • So 2 APs remaining operating in a 3 APs category is a fail passive, similarly if one AP remains operating in a 2 APs category is also a fail passive system.

ALI ALSALEEM - Ground instructor / Mideast Aviation Academy MEA - Jordan

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.