Everything the module has built so far can fly an approach; this lesson is about letting it finish the job. Autoland is the automatics completing the landing itself: flare, touchdown and the roll along the runway, in visibility so poor that a pilot could not have flown them by eye. It is also where the module's redundancy talk becomes concrete, because a system allowed to land the aircraft must be able to answer for its own failures all the way to the ground.
Why land automatically
The purpose of an autoland system is to complete the landing when the weather forbids a manual one: in fog and low cloud the visual references a pilot needs for the flare and touchdown may appear only seconds before the wheels, or not at all, and the automatics, flying the beams and the radio altimeter instead of the view, land the aircraft accurately and consistently through it. The same precision makes autoland a routine training and equipment-proving exercise in good weather too.
What it takes
Four components are named as required, and each carries its own significance:
Autopilot — more than one of them: this is the approach case the one-autopilot rule of the autopilot lesson made its exception for, additional autopilots joining when APP is armed so that the landing can survive a failure.
Autothrust — the speed must be flown as accurately as the path all the way to the flare, and the thrust reduction at the flare itself is part of the landing; the autothrust lesson at the end of this module covers the machine, this lesson only needs its presence.
Radio altimeter — the sensor that measures the aircraft's actual height above the ground directly, by radio reflection, rather than by pressure. The whole landing sequence is triggered by radio altitudes, so the radio altimeter is the autoland's clock; module 9 covers the instrument itself.
ILS receivers — the localizer and glideslope signals are the path being flown, and they must be received redundantly: independent receivers feeding independent autopilots, so a receiver failure does not blind the whole system.
The fail categories
The certification vocabulary (from CS-AWO, the certification specifications for all weather operations) grades what an autoland may do when something in it fails:
fail-passive automatic landing system — promises that a single failure produces no significant deviation of the flight path, attitude or trim, but the automatic landing cannot be completed: the system fails politely, hands the pilot an aircraft still in a safe state, and the pilot takes over.
fail-operational automatic landing system — promises more: after a single failure the approach, flare and landing can still be completed automatically, the surviving redundancy finishing the job.
fail-operational hybrid landing system — reaches the fail-operational standard by combination: a primary fail-passive automatic landing system plus a secondary, independent guidance system, such as a head-up display (HUD, guidance projected onto a transparent screen in the pilot's forward view), through which the pilot completes the landing manually if the primary system fails. One automatic lane, one human lane, independent of each other.
The sequence
A working autoland is mostly the previous lessons happening on schedule, and the crew's job is verifying the schedule. The FMAs announce the landing capability of the aircraft in the capability column (the CAT 3 of the previous lesson's strip), and the capability actually displayed decides what the crew may fly. On the way down, modes arm and engage automatically at defined radio altitudes and other thresholds, and the FMAs must be monitored to confirm each one: an arming that fails to appear is the earliest possible warning that the landing is not going to assemble itself. If a go-around is flown, the aircraft's manoeuvre is verified the same way: by reading the FMAs and supporting those readings with raw data, pitch, thrust and climb checked against what the annunciations claim.