If I was implementing it, from an automation point of view, the answer would be that
the aircraft chooses to surrender control. It only does that if the onboard computers feel something catastrophic has failed beyond what can be handled internally. Ground crews would not be able to take control unless the aircraft had already determined that something was very. very wrong (probably well beyond single engine failure).
Significantly larger emergency power would probably needed, even with increased efficiency. I don't think that's actually going to be a major barrier; modern aircraft are sometimes doing fully electric RATs (A350/A380) and I expect large batteries in place of the APU might show up on the next generation airliners.
Ideally I would be saying that an aircraft can remain in 'normal' law with full protections, automation, and continue to autoland following:
- Loss of anything that would already allow an aircraft to stay in normal law and land more-or-less normally, e.g. single engine failure, hydraulic failure, generator failure etc.
- Total loss of a single avionics bay (two firewalled bays is going to be necessary) or cockpit in the event of e.g. fire (that Egypt incident). Ideally, I'd want to be able to land as long as one of bay A, bay B, or cockpit (IFDS and direct law signalling) is intact.
- Total loss of a single class of sensors e.g. all AoA vanes or pitots frozen (XL airways A320, AF447)
- Loss of all GPS should be feasible.
- Loss of all IRS will be very hard to handle and would likely be managed by increasing redundancy and multiple suppliers/designs.
- Major fuel leak; detect, locate, isolate, and divert.
- Crew/cabin crew/ATC requests diversion
Reasons to go to off-plane emergency control would likely include:
- No thrust landing e.g. Sully, Gimli.
- Total loss of flight controls e.g. Sioux City, though ideally this will be fixed at the design stage.
- Major instrumentation failure e.g. both pitot and AoA gone or unreliable
- Loss of control inflight (stall, spin, etc.) - an automated airliner probably should never stall so if it does, something is clearly wrong.
- Something else unexpected and unexplainable where it cannot proceed. The Smartlynx A320 training flight is a good example of an 'unknown unknown' though that specific event should not reoccur.
- Edit: gear up and/or flaps up landing
- Edit: fire warnings, engine vibration etc.
FIve people in a room with no space constraints or smoke issues who do nothing but train for emergencies should do a much better job than two pilots who might be in masks.