Basic Questions regarding DH concept for CAT I/II/III Ops

[Pulser]

I have a question regarding the decision height concept during ILS approaches. I am only an enthusiast not holding any pilot license, so I am sure that I am missing some important points. However I am trying to understand the concept behind DH and what allows lower DHs (from a system point of view) for higher ILS Approach Categories (I/II/IIIa/IIIb).
What follows is a short summary of what I have read up to this point. Please correct me where I am wrong. My questions are integrated in this summary, where they fit. Assumption for my question is that the aircraft is not equipped with HUD.

---------------------------------------------------------------------
Fail/Passive Autoland System
The system is made up of 2 redundant units that guarantee the integrity of the whole system. As long as integrity is still given, the system is able to perform an autoland perfectly in the center of the touchdown zone. A violation of integrity (component in any of the 2 units failing) is detected via monitoring of unit inputs/outputs/internal data. In this case the system as a whole becomes passive. The aircraft is left in a situation where it is not significantly out of trim, but the autoland function is lost.

Fail/Op Autoland System
The system is made up of at least 3 redundant units that guarantee the integrity of the whole system. The 3rd redundant unit guarantees a higher availability of the autoland function. The first failure, causes the system to loose redundancy. Only after a second failure, integrity cannot be guaranteed anymore, which results in the system as a whole becoming passive. Autoland function is lost thereafter.

---------------------------------------------------------------------
CAT 1 Operations
No Fail/Op System required. In CAT 1 operations autoland should not be conducted as the beam quality may not sufficient (LVO not in force). The DH assures that the pilot can judge the point where he has to initiate the flare.

---------------------------------------------------------------------
CAT 2 Operations
No Fail/Op System required. In CAT 2 operations, autoland as well as manual landing would be allowed.

Q1: What is the reason for the DH being lower than in CAT 1 operation from a system point of view (is it due to the absence of beam fluctuations (LVO in force), and more stringent requirements for the ground equipment, allowing the pilot to rely on ILS data down to a lower height).

In CAT 2 operations the DH has to guarantee that the pilot is able to judge the flare point.

Q2: This seems to be clear when conducting a manual landing, but what’s the reason when performing an autoland. If a failure in the Fail/Passive autoland system would occur below DH, aircraft would not be out of trim, the failure would be announced to the pilot, after which he would be able to perform a G/A. Is he required to be visual when performing the go around from a low altitude, or what is the reason for a DH in CAT 2 autoland?

---------------------------------------------------------------------
CAT 3a Operations
No Fail/Op System required as long as DH>50ft. In CAT 3 operations, autoland would be mandatory, as visual references do not allow the pilot to continue visually. DH only has to guarantee that Pilot is able to judge if landing is performed within the touchdown zone.

Q3: Again same question as for CAT 2 autoland, why is DH necessary and why is it lower than for CAT 2 autoland?

---------------------------------------------------------------------
CAT 3b Operations
Fail Operational System with rollout system mandatory. Autoland would be mandatory, as visual references do not allow the pilot to continue visually. No DH necessary. Alert Height is chosen to meet the “robustness” of the system (bigger Alert Height, more robust system). Fail Operational System has a risk time within which it is guaranteed that no dual failure will occur. So probability of a loss of autoland function below Alert Height is sufficiently small.

Q4: Is this necessary to prevent the pilot from encountering a situation where he just touched down, selected the reverser (no G/A anymore) and the autoland system failing – leaving him in a situation where he has to continue landing manually without visual reference?

[Piltdown Man]

Overall I think you have missed the big picture. The idea of an approach is to land. Apart from a CAT IIIB landing, you have to have some sort of visual reference to land. The worse the visibility, the lower you have to go to see the runway. The lower you go, the greater the system integrity and training required. The very lowest minima flown to at the moment are CAT IIIB that require just 75 M RVR. You never ever have to be visual to perform a go around.

Q1 - CAT I Ops are performed to to a Decision Altitude, ie. based on barometric data and not radio altimeter. The minimal do not vary with LVP’s. These approaches can be flown by very basic aircraft. You can still autoland, but you have to make your decision based upon barometric minimums.

Q2 - With either a manual or autoland, you have to have the required visual references to continue beyond Decision Height. If conducting an autoland, any failure after DH is to likely to end up in a go around. That is because it is very difficult to “revert” lower than 100 above the runway. CAT II Manual landings may be required when the slope in the touchdown zone is beyond the aircraft’s limits.

Q3 - Improved airport infrastructure and system testing allows lower minima. Again, you have to have sufficient visual reference to continue beyond DH.

Q4 - The alert height is typically 100 feet above minimums no matter what the approach type, it has nothing to external or internal system integrity. There are also no guarantees that a systems will never fail, so you can always go around. But the reality is, weather limitations mean that if you have a system failure after selecting reverse you are at a point where the aircraft is rapidly losing speed and the aircraft is quite controllable. After all, you will still have 75 M RVR.

[Denti]

I guess alert height depends. Now on the A320 we use 100ft, on the 737NG with their newer fail operational system it used to be 200ft, although the alert height does not mean that no failures can happen, it means that single failures below alert height will still lead to a successful autoland. Never had any failures in real live, but at least in the SIM the 737 could cope with pretty much every single failure after 200ft, including complete loss of ILS signal and a wind shift from one side max crosswind to the other side max crosswind, not to mention the easy stuff of course like loss of engine/generator etc.

To be honest, losing automatic rollout with just 75m RVR would be very scary indeed, especially in the high speed portion of the rollout. I had to operate a few times in those visibilities, and just normal taxying basically slowed down to a 5kt crawl because everything else was just not possible.

[sheppey]

To be honest, losing automatic rollout with just 75m RVR would be very scary indeed, especially in the high speed portion of the rollout
That depends how realistic your simulator training is. All you have to do is manually track the localiser beam which keeps you on the centreline. This is easily done by using rudder pedal nose wheel steering. It is useful to know the DME distance of the roll-out end of the runway and use reverse and braking appropriately.

[Piltdown Man]

That depends how realistic your simulator training is. All you have to do is manually track the localiser beam which keeps you on the centreline. This is easily done by using rudder pedal nose wheel steering. It is useful to know the DME distance of the roll-out end of the runway and use reverse and braking appropriately.

I’m lost for words. To go heads down on a runway after an autoland and autopilot failure and be able to track the LLZ, gauging distance to go by DME... You are a far, far better pilot than I can ever hope to be. Chapeau!

PM

[RAT 5]

PM: thank you. Surely roll out is a eyes out manoeuvre even if there is 'supposedly' LLZ tracking. You know the LDA, you know LDR and the latter is less than former by a margin. You know you touched down in the Red barrettes, so you should know you've long enough tarmac to stop and the trusty auto brakes are set accordingly. All your size twelves have to do is sync with your eyes and the 15m centreline lights. If you see the Red/Whites and the speed is still speedy it is time to engage said size twelves in secondary mode.

Pulser: to clarify something. There is autopilot approach & manual land: there is manual approach & manual land: there is autopilot approach & automatic landing. There are CAT 1, Cat 2, Cat 3 operations. These are determined by the weather. ATC will introduce certain procedures for each and the operator will determine the type of approach performed considering the weather conditions in force. Different a/c have different capabilities. There are some that could perform CAT 2 ops in manual mode. There are/were some where the AFDS system was certified CAT 3B manual flight; but most operators didn't allow that and insisted on autoland.

You can auto land, under certain caveats, on a CAT 1 (category) ILS.

[InSoMnIaC]

Alert height is aircraft specific and is related to its fail operational design.

a simple example will illustrate its significance.

Say we are conducting a CAT 3a approach, and our alert height is 100’. Our FMA is indicating that we are CAT 3 capable.

Scenario 1: At a height ABOVE our alert height we have a failure that has downgraded our approach capability to CAT 2. (Eg 1 autopilot failure). We are visually ‘Alerted’ about this via a change on the FMA showing CAT 2. we are no longer capable of CAT 3a so we go around or if we are sufficiently above the runway, and have the required RVR, we can revert to a CAT 2 approach and continue.

Scenario 2: At a height BELOW our alert height the same failure happens. The aircraft will not ‘alert’ us of the failure. we are left ignorant of the fact that the system redundancy has downgraded. The aircraft can still conduct an automatic landing and considering the few seconds left in the approach, another failure that will render the system unable to autoland is highly improbable. Just incase a failure of that nature does occur though, we get an Autoland warning light. No real time to analyse the failure so the system only flashes one important red light in your face should the improbable occur.. If you’re still in the soup, Go around.

[sheppey]

To go heads down on a runway after an autoland and autopilot failure and be able to track the LLZ, gauging distance to go by DME

Believe it or not you don't have to be an ace to do that. It is similar to running into a bank of thick fog at 120 knots seconds after touch down or even blinding tropical rain where all forward vision is lost in a flash during a take off or landing roll.

Providing you are tuned in to the localiser for that runway for the landing or take off roll, it is relatively straight forward to maintain the centreline. In the simulator it can be practiced by merely turning off the visual display and hey presto problem solved. This is not new. During our military training of years ago we did blind take off under the hood as part of the instrument test. Of course there was a instructor or safety pilot if directional control was a problem, but it was doable and a great confidence builder on the basis that one day you might have to fall back on that type of basic instrument flying skill one foggy night; rare though that may be. Todays full flight simulators are engineering marvels; yet operators tend to stick rigidly to a regulatory requirements only, when it is equally important that pilots have training on real life events such as the above subject of loss of forward visibility during runway operations.

[Black Pudding]

Q4 - The alert height is typically 100 feet above minimums no matter what the approach type, it has nothing to external or internal system integrity. There are also no guarantees that a systems will never fail, so you can always go around. But the reality is, weather limitations mean that if you have a system failure after selecting reverse you are at a point where the aircraft is rapidly losing speed and the aircraft is quite controllable. After all, you will still have 75 M RVR.

Is alert height not suppose to be only for CAT III 3B with NO DH and it's 100 feet above touch down on a 320 and 200 feet above touch down on a 330, thus reference to radio altimeter. Don't know about other types.

[Pulser]

So to sum it up, one has to differentiate between:
- Actual weather conditions
- Operation CAT in force (determined by ATC), which would normally be determined to barely cover the actual weather conditions, as higher CATs could exclude operators with more basic equipment and would reduce traffic throughput
- Aircraft capabilities (CAT II/III F/P F/O)
- Ground equipment capabilities
- Crew capabilites

Now back to Q2:
So the reason why a (quite high) DH is required for an autoland in CAT 2 conditions (performed by a F/P system certified for CAT3a) is that the overall performance (including for example ground facilities) is determined by the "weakest" part of the system, which in this case might be the ground facilities operating according to CAT 2 standards?

Another question that is still not really clear to me is why a F/P autoland system requires a DH to be established. The system should alert the pilot in case of a failure, who could thereafter intiate a G/A even at low altitude.
The ICAO Manual of All-weather Operation states that for F/P systems "a DH is used with the intent to have adequate visual reference to support a possible manual roll-out during the period following touchdown". So the DH is required as most F/P system do not offer rollout capabilites - is that the whole story?

[sheppey]

You can auto land, under certain caveats, on a CAT 1 (category) ILS.
While not strictly legal in the airworthiness sense, the B737 Classics can autoland quite safely using one autopilot. The difference being there is no auto trimming back at 400 feet. The flare manoeuvre and touch down are the same for one or both autopilots.

[PEI_3721]

sheppy, a pedantic comment re #11; the 737 can autoland on one autopilot, but whether it is sensible to attempt it depends on the risks involved - if the risks do not minimise the likely hood of harm (compared with two autos) then the operation might not be ‘safe’.
Legality or not does not guarantee safety.

[Capt Fathom]

Can you have more than one autopilot engaged simultaneously?
One engaged and the other ‘armed?’

[MarkerInbound]

On the 744 and 748 all three autopilots are engaged descending through 1500 feet on an ILS. The aircraft doesn't know if it's VMC or CAT 3B outside, it treats all ILSs the same. Just a matter of when or if the crew disengages them.

[MarkerInbound]

So to sum it up, one has to differentiate between:
- Actual weather conditions
- Operation CAT in force (determined by ATC), which would normally be determined to barely cover the actual weather conditions, as higher CATs could exclude operators with more basic equipment and would reduce traffic throughput


In the FAA system ATC advises air crew what the current weather is and it is up to the crew to determine if they can land and what level of approach to use. The airport has certain low visibility procedures to put in place as the RVR goes down. But the reality is for me on a 744/748, if the weather is below CAT 1 and the approach is approved to CAT III I'll shot it as a CAT III. We autoland out of both a CAT II and CAT III so why complicate the approach looking for lights at 100 feet.