Sorry I'm just now catching up to this. Background: I was director of safety and a captain at a 135 operator that used airplanes that had this equipment, so I had to become VERY familiar with it.
FWIW, it was included on our passenger briefings in those airplanes. "If, somehow, both pilots were to become incapacitated, you push that big red button up there between them for three seconds, buckle yourself back in and enjoy the ride."
What kind of sorcery is this? This is game-changing. Does it sense the incapacitation and automatically invoke action? If so, how does it sense incap? Does it query the pilot after sensing a period of inactivity or something?
Three ways of activating it:
1) The Big Red Button.
2) If you are in LVL mode for 2 minutes. This can happen if you hit the LVL button, or if ESP has to make attitude/power corrections and there's no response from the pilot. If you don't take it out of LVL mode after two minutes, autoland is automatically activated.
3) If you got a CABIN ALTITUDE message at or above 15,000 feet, after 45 seconds Emergency Descent Mode is activated and the aircraft will go into FLC near max speed, HDG 90º left of current heading, and ALT will arm at 15,000 feet. Upon reaching 15,000 feet, HOMESAFE RQST comes on for 15 seconds and if there is no response, the system assumes the pilots are still out and autoland is automatically activated. That appears to be what happened here.
Being reported on another site there were 2 pilots onboard, it was inadvertent activation, and they didn't know how to deactivate it.
Say what? That has to be a joke that got taken seriously. If not, then the manual and training is incomplete.
It's in the manual... It's in the checklists, which is the more important thing as that should be where any pilot goes when encountering an abnormal/emergency situation.
Training, however, you may be right. There was a previous activation where the pilot hit the LVL button to show his friend how that worked, not realizing that he had to get all the autopilot axes back out of LVL mode within two minutes. Once it was activated he didn't know what to do. Not sure if that one went all the way to the ground or not, but it wasn't well publicized because it was an inadvertent activation and not an incapacitation. Some of our pilots were in the area and heard it on the ATC frequency they were on.
From what I have read plus a couple videos I have seen, a button has to be manually pushed to activate the system.
Nope - You have 2 minutes to respond after a LVL event and 45 seconds to respond after a cabin depressurization situation before the system activates itself.
But can’t you deactivate the auto land? Other than pulling an autopilot CB.
Yes, but it's not that simple.
Pull the circuit breaker.
There is no circuit breaker for autoland, and it would be HIGHLY inadvisable (and dangerous) to pull the autopilot or PFD/MFD breakers when autoland is active.
And just how is an incapacitated pilot supposed to do that?
There are at least two situations where the system will activate itself (see above) and if the pilots are incapacitated, passengers can activate it via the Big Red Button.
Deactivate with the AP disconnect button.
Ah, but pushing the A/P DISC is not enough to deactivate it...
As to crosswinds, the autoland looks at winds, weather, runway properties and picks the best airport with a precision GPS preferably a tower, less preferably a class-B, and a host of other inputs. Pretty well engineered.
It's incredibly well done. In fact, if radar shows an area of precipitation moving in the direction of the airport it initially chose, it can "change its mind" and select a different airport.
Does it even remember to lower the landing gear at an appropriate airspeed and time?
Yes. Gear and flaps... And it also brakes to a stop on the runway and shuts down the engines.
What a complicated system.
Does it use a published approach to find a runway?
Most likely, yes.
An aside; I wonder what the ICA says??
Should almost include a full operational test each year.
You can't do a full operational test as the plane has to make a quick trip to maintenance again afterwards; plus of course air traffic gets significantly disrupted.
There are ICAs and I remember there were some "odd" things you had to do annually in maintenance because of that, but I don't remember the specifics.
As I've been diving into the complexities of glass panel systems for our plane, and talking and reading about other pilots' experience with these systems, it has become pretty apparent that the in-depth systems knowledge needed to understand what is happening during "abnormal events" is lacking in a good number of pilots, not helped by a lack of training materials emphasizing how to handle various failure conditions. The problem with developing good training is that there are so many different systems, with boxes talking to each other in various ways, that there is no consistent way to deliver the training other than "you should really understand how your specific system is wired".
While I agree 100%, the autoland is currently only available for G3000 equipped airplanes, so they're all going to be wired the same at the factory.
I do expect that we'll be able to get this technology as a retrofit in the next 10 or so years, that will definitely make things more complicated.
Interesting. I'd not be happy if I was the operator. Putting myself in their shoes: I'm paying two pilots....why exactly? They elect to let the plane land itself rather than fly it? Autoland is pretty impressive, but from what I've seen plants the plane pretty solidly. Chance for a hard landing? Tying up ATC/the airport? Getting my company's name and our airplane all over the news? These guys would be looking for a new job. Meanwhile I'd also be furiously updating my 135 certificate to eliminate the second pilot.
You're paying two pilots to make good decisions. As I understand it, these guys were over the mountains, in IMC, and had just experienced a rapid decompression event. They could not descend to breathable altitudes in the area they were in; it's very difficult to communicate with the oxygen masks on, they were likely on a massive adrenaline high, and the airplane was flying itself to a safe place to land. There is no good reason I can think of for them to change what was happening.
The system lands fairly well from what I understand, it flares using the radar altimeter and there is no requirement for a hard landing inspection afterwards.
Tying up ATC and the airport for a few minutes is a helluva lot better than tying up the NTSB for a few months on a crash investigation and having two families grieve dead members.
"All news is good news" and all, this may turn out to be just fine if not a positive for the company.
Now, I think the autoland system does make a pretty compelling case for the autopilot in lieu of SIC OpSpec, but the best use of the second pilot isn't just to take over for an incapacitated PIC, it's to catch and correct any errors the PIC might make.
I don't fault them at all for letting it fly them down close to the airport. Plenty of time to wind their watches and run their checklists. I do fault them for letting it land itself.
The system should NOT be disabled on short final. In fact, there's a specific caution against doing so in the deactivation checklist. There's two checklists you need to run to get everything back, plus the MFD reboots and such. It takes at least a few minutes to get the plane fully back under control of the pilots with full instrumentation and properly configured.
Yeah that's what I heard too. I guess neither pilot can log the time or the landing though
Given that the FAA still considers time on autopilot to be good for the "sole manipulator" rule, whoever was PF should still be able to log it until there's case law to the contrary.
