Avionics safety systems leader Garmin had to define the hoops to jump through in the flight testing of Emergency Autoland, to ensure the technology provides the enhancement in safety as advertised for high-performance, single-pilot aircraft.

Emergency Autoland (otherwise known as Autoland) is a layer of Autonomí, Garmin’s menu of solutions that automate protection for pilots and passengers. It’s so far certified and flying on aircraft types from three airframe manufacturers, offered with the G3000 integrated touch-controlled flight deck.

Ultimately, Autoland avionics can take complete control of, and land, the aircraft in an emergency where the pilot is unable to fly — and even where passengers may also be incapacitated. You’ve heard stories of passengers or non-pilot crew who successfully landed an aircraft after the pilot became ill or died. That could conceivably happen, but more likely will have a catastrophic ending.

Garmin Autoland triggers automatically when it runs through a set of checks and decision gates to determine the pilot is unable to fly. Or, as a lesser priority fallback, any alert passenger can also engage the system with the push of a button in the cockpit. Once activated, the system calculates a flight plan to the most suitable airport, broadcasts intent to air traffic control (ATC), initiates an approach to the runway, and automatically lands the aircraft. It even applies brakes, and stops and shuts the engine down — all without human intervention.

We’ll take a look here at the challenges and highlights of the certification flight testing of Autoland. But before diving into those questions, we first had to ask a fundamental question of the Garmin company: “Why did you decide to do this?” Pilot incapacitation, in a single-pilot situation or not, is a rare event. From a pure dollars-and-cents viewpoint, how could this have made the cut to new product development?

Conor McDougall, aviation media relations specialist for Garmin International, set us straight on that score: “The mission of Autoland truly became a calling for us. There are so many cases where accidents happen and the aircraft was still operational, but maybe the pilot is incapacitated for one reason or another and is not in a position to fly the aircraft. It is such an awful and helpless feeling when you hear of these [situations].

“The entire Garmin team recognized we could make a difference here, and Phil Straub [executive vice president and managing director of aviation] personally viewed it as our responsibility,” McDougall continued. “The collective hard work and dedication paid off, but would not have been possible without each and every member of the team holding the same vision to make aviation safer.”

Skies had the privilege of speaking with Tom Carr, Garmin’s director of flight operations and chief test pilot, to learn about what went into the flight testing of Autoland. Carr was recently honored with the Society of Experimental Test Pilots’ Kincheloe Award, in recognition of his achievements as an experimental test pilot during the Autoland test program. He flew development flights on the Columbia 400, Cirrus Vision Jet, and Piper M600 as part of the Federal Aviation Administration (FAA) certification in 2020. His experience includes 192 different part 23 and part 25 aircraft types with more than 12,000 hours as pilot-in-command (PIC), and over 5,000 hours in the conduct of experimental flight tests. At Garmin, Carr oversees flight operations in Olathe, Kansas, and Salem, Oregon, and has flown multiple avionics development and certification programs.

Garmin has, of course, been doing development flight testing of avionics for some time. Skies wanted to know if the scope of the Autoland testing was different in terms of sheer effort from what has been done in the past. What were the major milestones and surprises?

“It was different for Garmin because of the sheer number of systems that had to be concurrently developed,” said Carr. “For example, mechanical systems; most aircraft, as far as what we interface to, are similar. They all have gear and flaps. But many of the airplanes that Autoland is targeting do not have antiskid, nor did our testbeds. Garmin had to engineer an automatic braking system (for non-power-brake aircraft) and create an antiskid solution — portable (up to a point) between new types.

“We had to design an autothrottle that was portable between turboprops and jets. Interfaces had to be developed to configure the airplane flaps and landing gear at the appropriate times. We had to develop the autopilot algorithms to execute the approach, flare, touchdown, [and] maintain centerline on rollout. Other control laws had to be developed to brake the airplane to a full stop while maintaining directional control, and shut down the engine.

He continued, “A robust routine algorithm had to be developed to take into account data at various airports (particularly runway lengths and the availability of emergency services), weather enroute, terrain enroute, fuel status, and many other inputs. Passenger-oriented displays had to be developed to ensure passengers knew what was happening, where they were going, and when they would arrive. Scripts were developed in concert with the FAA to determine what needed to be communicated” — including automatic broadcasts, setting the emergency transponder code, and broadcasting to the selected airport tower that a disabled aircraft is about to land on the runway.

As for surprises, Carr recalled one: “We at first didn’t realize what we might be up against with crosswind landings. We had to have a logical solution that worked down to the flare. Then, go to a different kind of mode to take out the crab to align the nose straight down the runway. That, I think, presented a lot more challenges than we thought. We couldn’t touch down on the upwind gear [as a human pilot might]. In the end, it worked.”

Carr also pointed out that there was little in the way of guidance material for this program. In other words, “all the performance criteria were things that we made up,” he said. “The overarching philosophy was, in our case, that the catastrophic event has already happened. So, we didn’t have to engineer-in redundancy. Air carrier aircraft have triplex Inertial Reference Systems, dual failsafe autopilot channels, antiskid, etc. That level of redundancy would prevent most business airplanes from being able to incorporate an Autoland system. Additionally, all the guidance material relative to displays is geared toward the pilot; in our case, the pilot is assumed to be incapacitated, so our displays are more focused on a surviving passenger.”

Two important components of Autoland include how the system senses pilot incapacitation, and how easy it is for a passenger to activate it — both of which required extensive testing. For the latter passenger-initiated activations, Carr said Garmin performed “human factors evaluations to determine how long it took passengers to recognize the situation and find the button. Garmin’s human factors team conducted simulator studies using more than 30 subjects, including non-pilots and pilots. We recommend pilots include the Autoland button in their passenger pre-flight briefing, since a quick familiarization will help the passengers know the system is onboard and help them find the button if they need it.

“As for the automatic means,” he continued, “we want to prevent nuisance alerts/activations while also providing meaningful safety supports around the pilot. For initial certification, Autoland uses two automatic features which had already been certified — Emergency Descent Mode (EDM) and Electronic Stability and Protection (ESP). EDM descends the aircraft from altitude if cabin pressure and/or cabin altitude indicate depressurization; the pilot doesn’t respond to cues from the avionics; or both, depending on aircraft configuration.

“With Autoland, if EDM descends through a threshold altitude and the pilot hasn’t turned it off, Autoland will activate, figuring the pilot is likely unconscious. If ESP is active for too long without the pilot taking corrective action, then the autopilot will engage into ‘Level Mode.’ If the pilot doesn’t react and take control in a set time period, Autoland will automatically engage.”

What happens when Autoland senses you are way too high and/or fast for setting up directly for an approach? Autoland knows what the “window” is to commence the approach from the final approach fix (FAF). If the airplane is too high, too fast, not adequately aligned with the final approach course, or not configured properly (flaps and landing gear), it will enter the holding pattern at the FAF until those parameters are met.

Carr also confirmed that the minimum requirement for Autoland to designate an airport runway as “good to go” is that it have a GPS approach with a vertical component. So, we had a few more questions: What database is used by Autoland as a basis to seek the nearest reasonable airport? One that existed already with the G3000? How does the system know if the otherwise best selected airport or runway was NOTAM’d closed?

Carr explained, “Autoland uses the same databases as the pilot does in normal use; these are the NAV[igation], Terrain and Obstacle databases. Long-term or permanent airport/runway closures make their way into the NAV database, and Autoland will not choose those airports/runways. Autoland does not yet interface with NOTAMs. Since Autoland broadcasts the aircraft’s current location, the destination airport, and the nature of the emergency, [like pilot incapacitation], Autoland does provide a warning to ATC and others listening as to which airport it has chosen. This may be useful in the unlikely event Autoland chooses an airport/runway which is NOTAM’d closed.

“We give the [airframe] manufacturers the ability to prioritize airports. For instance, in the case of needing to cater to pilots having a heart attack, they may want a priority placed on airports with emergency services. Databases contain information on towered and non-towered airports, so the expectation is an airport with a tower can coordinate summoning emergency services. And it knows how much fuel you have remaining and whether you have to climb over terrain, and if you have the fuel for that. It runs all those things, and we know from the onboard weather [avionics] to avoid an airport with a thunderstorm going on.”  

Candidate airframes must have their peripheral systems controlled — engine power and condition levers, pressurization, gear, and flaps. Was it challenging to test that those systems were not adversely affected by remotely controlling them? Not really. Garmin could test those systems and any adverse effects pretty easily, and do so in the normal course of business on other things the systems control. So, Garmin was pretty confident in that. 

For some things, Garmin could not actually test the real hardware/software until the certification test. For example, “We could not test the automatic broadcasts on the communications radio, or allow the system to input the emergency transponder code, as this would have affected ongoing ATC operations,” said Carr. 

What about flight test instrumentation? “Most of what we need we can read off of our data bus,” he added. “We connect to the data bus, and our flight test engineers have the ability to real-time look at the data — things like descent rates. They are the ones who are actually changing the gains; [they’d] make a change, and we’d come back and do it again.

“A single test flight might involve 20 to 25 approaches to landing. It might not even involve flight; for instance, we had to deal with steering in aircraft with both nosewheel steering and castering nose gear. It all had to be tested. On a given sortie we might do 30 passes down the runway and never leave the ground. We do different rates, speeds, and offsets, and make changes to the algorithm without leaving the ground. We also record everything on the data bus, and we can take that and re-fly the whole flight on one of our simulators.”

Garmin’s Emergency Autoland is so far certified and available on Daher’s TBM 940 as HomeSafe, the Cirrus Vision Jet as Safe Return, and the Piper M600/SLS as the HALO Safety System. What’s next? More Autoland programs are in the works, which for the foreseeable future will also be on new production aircraft offered with GX000 flight decks. Garmin just introduced Smart Rudder Bias for piston twins, which automatically applies corrective rudder in engine-out situations. ESP also kicks in, preventing excessive roll and raising the wing with the inoperative engine. ESP’s underspeed protection will pitch nose-down at a safe margin above minimum control speed (Vmc), preserving airspeed and preventing loss of control.

Over the coming years, it will be interesting to see how this technology advancement could play a part in supporting a possible future move towards reduced-crew operations for commercial airliners, from two pilots to one.

Garmin is paving the way toward a new era of flight, where both safety and efficiency are at the forefront.