Let us look at the statements and see how right or wrong they are.
Fail operational - Where you have 3 autopilots engaged, such that any single failure will result in the remaining 2 autopilots being
able to safely land the aircraft. That is if there is a failure
autoland remains operational.
First of all, this statement is not wrong. It is as a matter of correct. Yes, if an aircraft has 3 autopilots, it will remain fail operational if one of them malfunctions during an automatic landing. But you do not need 3 autopilots to achieve fail operational capability. If you want to have fail operational capability with two autopilots, you need two fully independent auto pilot performance monitoring systems. All Airbus aircraft starting from the A320 have two autopilots and they all have fail operational automatic landing systems.
Fail Passive - Where you have 2 autopilots engaged, such that a single autopilot failure will result in the disengagement of both
autopilots with no significant deviation from the established flight
path. In this case the pilot must manually take control and
This statement is wrong. With two autopilots engaged, if a single autopilot were to fail, the system becomes fail passive. It is not necessary for the other autopilot to disengage. And in some certain cases, the aircraft can even perform an automatic landing with a single autopilot (in this case it remains fail operational). I will explain how it works later on.
Here are the JAA (current EASA) definitions of both the fail operational and fail passive.
An automatic landing system is fail-operational if, in the event of a
failure below alert height, the approach, the flare and landing can be
completed by the remaining part of the automatic system. In the event
of failure, the automatic landing system will operate as a
An automatic landing system is fail-passive if, in the event of a
failure, there is no significant out-of-trim condition or deviation of
flight path or attitude but the landing is not completed
automatically. For a fail-passive automatic landing system the pilot
assumes control of the aircraft after a failure.
If we look at the definition for fail operational, you can see that it does not say anything about 3 autopilots. But it says something about an alert height. It says below alert height, a system is fail operational if after a failure in the automatic system, an aircraft is still able to perform an automatic landing with the remaining part of the automatics system. So, what is this alert height?
According to the Airbus A320 FCTM:
The Alert Height (AH) is the height above the runway, based on the
characteristics of the aeroplane and its fail-operational automatic
landing system, above which a CATIII approach would be discontinued
and a missed approach initiated if a failure occurred in one of the
redundant parts of the automatic landing system, or in the relevant
Alert height is an altitude derived by the aircraft manufacturer during aircraft certification (AH for A320 is 100ft).It is the minimum height at or below which an aircraft is allowed to perform an automatic landing after a failure in its redundant automatic systems. So, for example in an A320, if you were doing an automatic landing with both autopilots engaged and if one of the autopilots fail above the alert height which is 100ft, you will immediately commence a go around.
So, what if one of the autopilots fails below 100ft? The answer for this is it depends. Remember us talking of an autopilot performance monitoring system? In the A320, there is an AUTOLAND warning light on the glare shield of each pilot. This light flickers below 200ft if following conditions are encountered:
- Both APs trip off
- Excessive beam deviation is sensed
- Localizer or glide slope transmitter or receiver fails
- RA discrepancy of at least 15 ft is sensed.
The warning light is triggered by the monitoring system, if it detects any of the failures above. So, when below AH, the automatic landing can be continued even if one of the autopilots trip off as long as the AUTOLAND light does not come on. If the AUTOLAND light comes on, you should immediately go around.
Here is a little GIF of the AUTOLAND warning light test of A320 done by me. You can test if it works just by pressing it any time you like (even in flight). If you press it, the light comes on and it goes.