Flying Garmin's New Emergency Autoland
You’re the owner/operator of a single-engine turboprop. You’ve launched from Colorado Springs Municipal Airport bound for San Jose, California, during monsoon season. The evening departure and climb-out are uneventful, but it starts to get bumpy as you enter the cloud layers abeam Pikes Peak. Even though you’ve flown through plenty of turbulence, tonight you aren’t comfortable. Your stomach is queasy. You’re short of breath. And then you feel sharp little pangs in your chest.
Keep this to yourself, you reason. No need to alarm the family members aboard. After all, they’re depending on you to get them back on the ground safely, because you’re the only pilot.
A half hour into the flight, however, it becomes hard for you to focus on the instruments and maintain your mental plot. The others notice and they’re worried.
“Are you OK?” is the last thing you remember hearing from your spouse. Your breathing is hard and shallow. Your chest aches. You think you’re about to pass out.
The scenario very well could end with fatal consequences in most single-pilot general aviation aircraft. Pilot incapacitation is a nightmare no passenger wants to imagine, especially with only one aviator up front. The history of owner-flown single-pilot turbine aircraft is peppered with dozens of fatal accidents caused by pilot error, disorientation or incapacitation.
This airplane, though, is equipped with the latest Garmin G3000 NX avionics package. A guarded red button has been added to the flight deck layout, within easy reach of the passengers. It very well could be called the “No Panic Button.” When pushed by anybody — including the pilot — it activates an emergency autoland function. This is essentially a virtual, digital copilot that can take over control of the aircraft, evaluate winds, weather and fuel reserves, then select a suitable divert field and fly the aircraft to the best runway at the landing facility.
The system also switches the transponder to a special emergency autoland squawk code pre-assigned by the FAA, makes all required radio calls to advise ATC of the situation and uses the EFIS screens and the aircraft intercom system to brief those aboard and keep them updated as to where and when the aircraft will land. And, if the need arises, passengers can communicate directly with ATC by following simple instructions displayed on screen.
Emergency autoland can control the aircraft in all three axes, adjust the throttle, extend the landing gear and flaps as appropriate and guide the aircraft to the touchdown zone. It will crab into a crosswind and then transition to wing down/top rudder to align the aircraft with runway centerline. After landing, it uses differential braking to stay on center and bring the aircraft to a smooth stop. It even has an anti-skid function to modulate braking on slippery surfaces. It also can shut down the engine to prevent a prop strike injury as people exit the aircraft.
Mind you, autoland is no laboratory experiment. Garmin started to have discussions about the feature in 2001. The program officially was launched in 2010, and eventually more than 100 hardware and software engineers, plus human factors experts and sales executives became involved. Flight tests using a Cessna Corvalis 400 began in 2014 and eventually 329 test landings were completed. Another 300 landings were flown in various other aircraft. In early 2018, Piper and Garmin began flight tests in a modified Piper M600 single-engine turboprop to validate the technology for pending FAA approval. More than 170 landings now have been completed.
By late 2019, Piper and Garmin expected FAA certification of the system aboard the Piper M600. It’s slated to be cut into production as standard equipment for 2020 models. Autoland is part of Garmin’s newly branded Autonomí package, which also includes emergency descent mode and electronic stability and protection. Expect similar emergency autoland capability announcements from Cirrus by the end of this year and Daher in mid-2020.
Flight Demo of Piper’s Halo System
To see emergency autoland in action, we belted into the right seat of an M600 equipped with the system at Garmin’s New Century AirCenter Airport (KIXD), Olathe, Kansas, facility. Eric Sargent, engineer and flight test pilot, flew the aircraft from the left seat. Bailey Scheel, aviation systems engineer who leads the M600 development program, and media relations specialist Jessica Koss accompanied us in the main cabin.
Emergency autoland is part of Piper’s 2020 M600 Halo system, a standard bundle of advanced safety equipment for the new model year that also includes stability and underspeed protection, emergency descent mode, pitch and wings level mode and coupled go-around. Key to some of these features is the model’s new autothrottle capability. It first will have limited functionality for safety functions. Piper plans to offer a full-function autothrottle by year-end.
Garmin provides a basic functionality template package to aircraft manufacturers, enabling them to customize autoland to best fit the needs of their customers, explained Scheel. The airframers are given options for how the system should interact with flap actuators, anti-ice and other aircraft systems, wheel brakes and steering. They can also decide what kind of en route and destination winds and weather criteria should be used for choosing a suitable divert airport. In addition, the system can assess weather reports to screen out divert fields with hazardous meteorological conditions.
In the case of that hypothetical single-engine turboprop flying from Colorado Springs to San Jose, activation of autoland overhead Central Colorado Regional Airport (KAEJ) in Buena Vista, Colorado, might cause the system instead to choose Grand Junction Regional (KGJT) as the divert field, about 115 nm away, to avoid storms over the Rockies. It also uses its digital terrain database to assure the aircraft stays safely above the rocks while it maneuvers toward the divert field and descends for approach and landing. Furthermore, it would change the landing field elevation used by the pressurization system from 62 ft. for San Jose to 4,861 ft. for KGJT.
The first version of autoland can only use runway ends served by GPS LPV or LNAV/VNAV approaches. Close to 12,000 such procedures are available, but not all landing strips meet each aircraft manufacturer’s specific needs of minimum requirements for runway surface, length and width, along with weather observation broadcasting at the landing facility.
Scheel says 7,000 ft. of pavement would have been the minimum practical stopping distance for the M600 using no flaps. Such high minimums would have been too restrictive, as there just aren’t that many airports with long runways and GPS approaches in the U.S. Using full flaps would have provided access to 9,600 runways. But Piper chose to use takeoff/approach flaps as the best compromise because of the possibility of operating in icing conditions causing ice accretion on the airframe. The minimum landing distance thus became 4,500 ft., which still provides access to more than 9,000 runways. Autoland ties into the M600’s ice protection systems. If the outside air temperature drops below the threshold for icing, they’re activated, even if the aircraft is not flying through visible moisture. The entire autoland package adds only 25 lb. to aircraft empty weight.
We departed KIXD to the southwest, climbing to 4,500 ft. MSL. When we were about 15 mi. from the airport, Sargent gave me the OK to lift the guard and press the red button.
Smoothly, the autopilot and autothrottle engaged. The aircraft headed for KIXD, the closest suitable airport with sufficiently long and wide runways, plus GPS precision approaches. A direct route to New Century Airport was also free of weather hazards.
The aircraft accelerated to 230 KIAS, 20 kt. shy of redline. Piper chose that speed to get the aircraft on the ground expeditiously, in case the pilot needs immediate medical treatment.
Because this was a demo, emergency autoland did not switch the comm radios to 121.5 MHz, wait for silence on frequency and then transmit the aircraft’s intentions. It also did not switch the transponder to an emergency code. Sargent instead informed New Century tower of our intention to fly the RNAV (GPS) Runway 36 approach in VFR conditions.
Just after the aircraft started to turn back to the airport, all three EFIS screens and both touchscreen control panels switched from avionics mode to passenger advisory mode.
“Emergency Autoland Has Been Activated” appeared on the MFD. “No Action Required” popped up on the bottom of the display. “Calculating ETA,” advised the system. An animated graphic then appeared, highlighting the yokes and rudder pedals. “Keep Hands and Feet Away from Aircraft Controls.”
The primary flight displays transition to combined synthetic vision and moving map displays, keeping all of us well informed of the aircraft’s progress en route to the divert airport. The top displayed “Landing in 9 minutes” while the bottom showed “En route to New Century Aircenter — Olathe, KS.” The screen showed that we were headed to the approach end of Runway 36.
As we neared the airport, the aircraft was too high and fast to commence the RNAV approach. It automatically slowed to 140 KIAS, followed the holding pattern depicted in lieu of procedure turn and descended to 3,100 ft. as required by the approach procedure. When level, it automatically extended the landing gear and flaps to takeoff/approach.
Aligned with the final approach course inbound, it slowed to 105 KIAS and started down on the glidepath. The MFD screen alternated between a moving map with time and distance-to-go advisories and various passenger advisory messages, including how to use the comm radio, check seat belts and shoulder harnesses fastened, stow loose items in seat-back pockets and wait for the aircraft to stop before exiting.
Sargent commented that the hardest part of refining autoland was the flare phase in the last 5 to 10 ft. above the pavement. The aircraft has to make crosswind corrections, respond to gusts, adjust to runway undulations, slowly retard the throttle to idle and steer to maintain center runway alignment. Touchdown must be both smooth and precise to stop on the available pavement. In the end, the system landed us as well as an accomplished M600 human pilot.
It also has to use differential braking for steering and stopping, accounting for undulations in the surface and runway contamination. Aboard the M600, dual autothrottle servos actuate a hidden set of brake master cylinders to modulate brake pressure while monitoring wheel speed deceleration to avoid skidding on slippery surfaces.
After touchdown, animations on the MFD advised us of how to unbuckle our seat belts and how to open the cabin door. If we had let the system run through all its functions, it would also have shut down the engine.
Sargent commented that emergency autoland also can automatically activate in extreme circumstances. Following an emergency descent, for instance, the G3000 will prompt pilots for responses to assure they’re conscious. If they respond, the system remains unarmed. But if they don’t respond, emergency autoland would activate.
At any time, emergency autoland can be disarmed by pressing the disconnect button on the yoke. Sargent says that anyone aboard the aircraft can intervene. A pilot who regains consciousness, for instance, might take over from the system as the aircraft nears the autoland divert destination. A passenger with limited flying experience could disconnect the system after landing and taxi the aircraft clear of the runway.
Piper says the entire Halo system, including extra cost equipment now made standard, has a $170,000 market value. Interior upgrades and a five-year tip-to-tail warranty add another $130,000 of value. But the retail price increase is being held to 2%.
Cirrus SF50 Vision Jet
Slated for certification this year and for 2020 deliveries, Cirrus brands its system “safe return autoland,” according to Matthew Bergwall, director of the Vision Jet product line.
“It’s part of a total safety solution that also includes Cirrus Aircraft Parachute System [CAPS],” says Bergwall. “In case autoland is not available, the G3000 screens will provide instructions as to how to activate CAPS. We bookend all the risk scenarios you could have in flight.” For instance, CAPS is available as an escape from loss of control inflight.
Similar to the M600 autoland system, the Vision Jet’s safe return autoland will tie into the autopilot, autothrottle, pressurization, landing gear and flap, plus wheel brake systems. Runways must be served by a GPS approach capable of vertical guidance. The system will be programmed to fly 160 to 180 KIAS to the initial approach fix, 140 KIAS during maneuvering with the final approach course inbound and 100 KIAS on final approach. Bergwall says the top mount location of the FJ33 turbofan and low idle thrust eliminate the need to shut down the engine after the aircraft comes to a stop on the runway.
As with the M600, autoland will configure the aircraft with takeoff/approach flaps for landing. To account for degraded stopping on contaminated runways, Cirrus uses a 5,836-ft. minimum landing runway length. Incremental empty weight gain of safe return autoland should be close to 25 lb.
Nicolas Chabbert, Daher’s senior vice president, says emergency autoland definitely will be offered on its TBM 900 series aircraft. But he’s taking a go-slow approach because of the complexities of implementing it on an aircraft that cruises as fast as 330 KTAS and as far as 1,500 nm. At FL 310, for instance, there may be dozens of candidate divert fields because of the aircraft’s high-altitude fuel efficiency. The number diminishes considerably at low altitude because of increased fuel consumption and lower cruise speeds. Those factors need to be incorporated into such a system for the TBM.
Daher is also exploring an automatic ditching capability for the system for extended overwater flights during which no suitable divert field is available.
The current system requires a GPS approach with vertical guidance to the runway end of the divert field. And only paved runways are in the airport database. Chabbert believes those limitations may be too restrictive. Thus, Daher wants to evaluate the potential use of shorter, unpaved strips without precision GPS approaches.
Chabbert believes the G3000 needs more computing power and more memory “for the dynamic environment in which our aircraft operates.” He’s also concerned that while the FAA may approve the system, the European Aviation Safety Agency may impose stricter certification requirements. Politics, as well as science, must be considered. As an example, he believes that the high traffic density within Berlin, Paris and London airspace may cause EASA to outlaw using major air carrier airports as autoland divert fields. “EASA certification may be a challenge,” he said.
Chabbert adds “Our target audience is not the pilot. It’s the passengers. We’re totally committed to safety, and we’ll offer it when we have a finalized product.”
Other OEM Applications
Industry observers tell BCA that emergency autoland will become a compelling sales advantage in the single-pilot turbine business aircraft market, as well as in the single-engine turbine segment. Aircraft equipped with G1000 systems don’t have the capability to support the function. Thus, airframers that currently equip their aircraft with G1000 avionics packages must consider upgrading to the G3000.
Garmin is the only avionics manufacturer to offer emergency autoland at present. Some believe the company has invested as much as $20 million, or more, in the technology. One can only speculate whether any competitors are willing to make such a sizable investment to develop the capability.
Reflecting on Chabbert’s comment about passengers being autoland’s target audience, if one is considering purchasing one of two closely matched aircraft, but one features Garmin’s G3000 with emergency autoland and the other does not have that capability, the buyer’s spouse, family and friends, company leaders, board members and other stakeholders may sway the purchase decision.
In the near future, the “No Panic Button” autoland system could become perceived as minimum required safety equipment, along with oxygen masks, seat belts, fire extinguishers and emergency exits. Garmin isn’t just creating a breakthrough avionics technology. It’s changing customer expectations for minimum equipment lists on single-pilot aircraft.