The advancement of technology has continually led to improvements in aviation safety. From autopilot to ACAS and GPWS to ballistic parachutes – there are many well-known examples. Now, there is another new technology available to the general aviation community – Emergency Autoland.
Since 2017, EASA has been working closely with the FAA and Garmin to support the certification and implementation of the Garmin Emergency Autoland System. The core functionality is currently hosted in the Garmin G3000 integrated flight deck that can be installed on various different aircraft types[1]. Some manufacturers also refer to the system with their own marketing names such as HomeSafe – worth knowing if you are searching the internet for more information.
We created this article with two types of people in mind
- Firstly, if you are a pilot you will learn more about the key features of Emergency Autoland so that you are aware of its functionalities. Hopefully this will encourage more pilots to choose this safety feature when purchasing a new aircraft or, in the future, potentially upgrading equipment in your current aircraft. Where installed, it is also important to be aware that passengers should be briefed on the basics of the system so they can take the right actions during an emergency.
- Secondly, if you are an air traffic controller (civilian or military), flight information officer or work in operations for an ANSP, you probably have a lot of questions about how the system works and what happens if an aircraft under emergency-autoland control enters your airspace. It’s definitely important to make sure that you and your organisation has considered this situation and how controllers would handle a situation where an aircraft is conducting an emergency autoland.
EASA certification on the Daher TBM-940
The Garmin G3000 with emergency autoland is fitted to a number of different aircraft. In a second activity of aircraft certification, EASA has worked with Daher to certify the system on the Daher TBM-940 aircraft. This work was supported by DGAC France and the French flight test center CEV along with the help and participation of the ATS of France culminated in the first full system test with ATS participation, with the aircraft making a successful landing stopping and shutting down, without pilot intervention.
The benefits of emergency autoland – What the system does?
Should a pilot be incapacitated, the emergency autoland can be automatically or manually engaged – by either passengers or pilot. So, instead of the aircraft flying uncontrolled or along a path already programmed into the FMS until the fuel runs out, the system will decide on the most suitable airfield for landing. It will then automatically navigate to that airfield while avoiding known terrain and weather hazards. The system will then set up the aircraft for landing, touchdown and bring the aircraft to a full stop. You can probably imagine lots of situations where having such a system onboard could save lives. In the event of hypoxia, the pilot can take back control at any time should they recover sufficiently to land the aircraft themselves.
Currently, with respect to uncontrolled aircraft – unless there are passengers with knowledge on how to operate the aircraft’s radio, Air Traffic Control (ATC) may not be aware of the serious situation in progress. With emergency autoland activated, the system transmits its intentions to ATC allowing controllers to know the system’s intention and to take actions accordingly. It is important to understand that it is also possible for anyone on board the aircraft to continue to communicate with ATC, provided they have a headset. This ability further mitigates the risks associated with this type of emergency operation.
You can get a full overview of the system by watching this video by AvWeb contributor and Aviation Consumer magazine magazine Editor-in-Chief Larry Anglisano.
In-flight assistance
An emergency autoland system is a great way to enjoy flying with the added protection of a system that can safely land the aircraft in an emergency. The system can be manually activated by passengers or the pilot in order to provide in-flight assistance. Different aircraft have slightly different systems. In the Cirrus it's a big red button on the ceiling between the pilot's seats, in the M600 it is at the top-center on the instrument panel, while it is the“Homesafe” button in the Daher. The Garmin G3000 also monitors pilot activity/inactivity, aircraft attitude and cabin pressure and can automatically engage autoland or emergency descent mode if no activity or unsafe attitudes are detected.
Make sure the front occupant’s hands and feet are clear of the controls
Once activated, the system causes the flight controls to move by themselves. It is important that the front-seat occupant’s hands and feet are clear of the controls so that the controls operate correctly – pay particular attention to the rudder pedals. If you have the system installed in your aircraft, be sure to brief your passengers. – This could be very important in an emergency.
Keeping the pilot and passengers informed
Within 15 seconds of being activated, the system will provide information inside the aircraft via the three large screens and smaller touchscreens. This information will also be available audibly via headsets and cockpit audio. This may be a good reason for headsets to be available for passengers. There will be pictures and possibly a series of videos played during different parts of the flight to assist in keeping everyone calm and informed. The video from Daher (as of 2:44 mins) provides a great overview of how the information screens work and the information that they provide. Information on the route, landing place and time is provided clearly, should this be needed by anyone during the approach and landing or for other communications with ATC.
The whole system is designed to provide only the most important information needed to keep people informed (and calm), and to make it as easy as possible to for everyone to communicate effectively. If a passenger needs to communicate with ATC, they need to use a headset in one of the front seats of the aircraft and follow the touchscreen prompts.
Finding the optimal destination while avoiding known hazards
After having been activated, the emergency autoland system selects the best airport, which will have a published GNSS-based-instrument approach, for landing. When doing this it takes into account a wide range of factors such as runway length and width, flight distance, fuel range, terrain, weather and others. The system is continually monitoring for known terrain and weather hazards right down to landing. You can learn more about this process from the 2 minute mark of the Cirrus video below.
Creating a safe flight path and informing ATC
The system will avoid Class B airports and prohibited airspaces around the world, but it will not avoid other airspace classes or airspace structures like dangerous, restricted and segregated areas. If the aircraft is in Class B airspace or approaching Class B airspace, it will normally select a satellite airport in or near Class B airspace as a destination rather than the primary airport. If the weather at the selected destination changes such that it exceeds allowable precipitation levels, then a new destination will be selected.
While notifying ATC, the FMS pilots the aircraft to a fix where it intercepts and flies the approach. Weather, terrain and obstacle clearance are integral parts of the route management. The aircraft will fly the approach, flare appropriately, land, self-brake until stopped, shut down the engine(s), and alert on the last selected ATC or aerodrome frequency that the aircraft has landed and the landing runway is occupied.
Right down to the final stop
The emergency autoland system takes the aircraft all the way through approach and landing to the final stop on the runway. Throughout the final approach, the system adjusts the throttle and flight controls. Then, immediately prior to touchdown, it flares the aircraft for a landing before the brakes are applied and the aircraft is brought to a full stop. Knowing that such an emergency system is there to protect your loved ones or most important assets provides peace of mind.
Can be deactivated if needed
There may be situations where the pilot later regains the ability to land the aircraft themselves. If needed, the emergency autoland can be deactivated and the pilot can take back full control of the aircraft. Having this ability shows just how flexible and useful this system is for pilots.
Announces intentions and communicating with ATC
One of the most challenging parts of the emergency autoland system is the potential impact on the ATM system. The system announces its intentions at ….frequency etc… While the system can broadcast its intentions and provide information to ATC, it isn’t able to act on instructions received from controllers. It is important that ANSPs and other ATC organisations consider what actions their staff should take in the event of an emergency autoland in their airspace, in line with normal emergency procedures. It is essential that controllers are aware of what an emergency autoland system is and how such an aircraft should be handled.
Squawk 7700 and radio broadcasts
The aircraft will automatically squawk 7700 at all times when the system is in operation. It will also inform ATC about the emergency and other key information including the aircraft call sign, that emergency autoland has been initiated, the destination airfield, landing runway and the time of arrival. It is also possible for passengers to speak to ATC, provided they are wearing a headset and are seated in one of the front seats of the aircraft. The passenger is then provided with clear information about the aircraft and its destination should they need to communicate to ATC themselves. The displays in the cockpit have been simplified with exactly this situation in mind.
Automated broadcasts
Throughout an Emergency Autoland event, the system transmits messages so that ATC and other pilots in the area are aware of what is going on. It is also clever enough to monitor for radio traffic on the radio frequencies prior to transmitting the automated emergency communication to ensure the likelihood of it being heard.
1. Upon activation, the system will transmit on the pilot’s previous frequency:
"May-day, May-day, May-day, aircraft <tail number> has activated an emergency automatic landing system. Standby for information."
2. Twenty-five seconds after activation, the system will transmit a second message on the pilot’s previous frequency:
"Aircraft <tail number>, pilot incapacitation, <distance from destination airport> miles <direction from destination airport> of <destination airport>, emergency Autoland in <estimated time remaining> on runway <runway> at <destination airport>."
3. The system will begin transmitting on 121.5 MHz with a 5-minute gap between messages until the system is deactivated:
Initial message to 121.5 MHz: "Aircraft <tail number>, diverting to <destination airport> on runway <runway>."
Subsequent messages: "Aircraft <tail number>, pilot incapacitation, <distance from destination airport> miles <direction from destination airport> of <destination airport>, emergency Autoland in <estimated time remaining> on runway <runway> at <destination airport>."
After landing: "Attention <destination airport> traffic, aircraft <tail number> disabled on runway <runway>."
After the initial automated transmissions, the system allows the aircraft occupants to transmit over the emergency frequency. An occupant-initiated transmission cancels or delays an active or pending automated transmission.
Near the airport
When the aircraft is within 12 nautical miles and 10,000 feet of the selected airport, the system will transmit messages to the CTAF frequency for the selected airport (if there is no CTAF frequency, then the system uses the tower frequency. If there is no CTAF or tower frequencies, then UNICOM is used). This is done with a 3-minute gap between messages until the system is deactivated.
"Aircraft <tail number>, pilot incapacitation, <distance from destination airport> miles <direction from destination airport> of <destination airport>, emergency Autoland in <estimated time remaining> on runway <runway> at <destination airport>."
After landing: "Attention <destination airport> traffic, aircraft <tail number> disabled on runway <runway>."
In the unlikely event that a destination cannot be found
In the unusual situation in which emergency autoland cannot find a destination airport or needs to climb, the system will transmit the following message on 121.5 MHz with a 5-minute interval until a destination is found (at which point it will switch to transmitting the standard messages above) or the system is deactivated.
“Aircraft <tail number>, pilot incapacitation. Searching for a destination.”
The system will only start a climb and search if there are no suitable airports nearby. When it does so, it will be limited to the configured maximum climb altitude. Functionally, this means that the system will climb and search if there are no airports nearby, if the airplane needs to climb to avoid terrain, since there are no airports ‘nearby’…we can’t go through terrain or the aircraft is below the Final Approach Fix (FAF) altitude.
Some limitations to be aware of
The emergency autoland system is designed to be used in emergency situations only and should not be used in when the pilot is fully capable of landing the aircraft. It’s not designed or approved for use as part of a normal flight.
The airport list for Autoland is comprised of any suitable airports within a 200 nautical mile radius, any airports the aircraft has passed since “power on” within 200 nautical miles and the destination airport in the flight plan. For aircraft that are located in remote areas or over large bodies of water, autoland may not be able to initially select a destination. Therefore, it will continue to fly straight and level while searching for a viable solution. Having identified a suitable airport, the system will announce its intentions to ATC. Thankfully, here in Europe, there is almost no chance that you will find yourself outside these parameters.
It’s also worth noting that the emergency autoland may not function if the aircraft is experiencing mechanical issues or fuel exhaustion, or if the flight controls are not able to move freely. It’s important to make sure that the aircraft systems are well maintained and also that the flight controls are clear of hands, feet and anything else once the system has been activated. Finally, autoland also requires the Garmin avionics and AFCS systems to be operational for the feature to land the aircraft.
Summary and key points
The Emergency Autoland or HomeSafe system is a great step forward in safety technology. While its only available on a small number of aircraft at this stage, this is hopefully just the first step in assistive technologies that will be able to help the pilot in an emergency.
If you are a pilot, looking to buy an aircraft on which this system is available, it is a very worthwhile safety function that gives real peace of mind. When using the system, follow these A-B-Cs to make sure that it has the greatest chance of saving lives:
- Airworthiness — Keep your aircraft well maintained to ensure that the system works properly when you need it;
- Briefing —Make sure that passengers have been briefing on the system before the flight.
- Controls Clear — Remind passengers of the need to ensure that the controls are free of hands and feet when the system is in operation.
If you are a controller or work in an ANSP, make sure everyone knows about this new emergency autoland system and its operation is incorporated into your training and emergency procedures.
[1] Aircraft currently approved are Cirrus Vision Jet, Daher TBM 940 and Piper M600 SLS.
You are not allowed to comment on content in a group you are not member of.
General Aviation