Your punishment for whatever mistake you’ve made in an airplane shouldn’t be the ultimate one. Not for you—and certainly not for your passengers.
That’s the underlying philosophy inspiring engineers to create revolutionary safety technologies for light aircraft across the past century. Advancements such as the large-format multifunction display with in-cockpit weather, upset protection and emergency-descent protocols—and whole-airframe ballistic recovery systems—stem from this drive toward solving our mistakes as pilots. Case in point: About 20 years ago, Cirrus delivered the airframe parachute to a certificated light airplane as standard equipment—known as the Cirrus Airframe Parachute System. Just a year or two later, Cirrus debuted its version of the wide-horizon primary flight display—around the same time as in the Lancair Columbia—but soon after, the innovative PFD followed in a cascade of single-engine pistons and twins.
Proponents saw into the future with the possibilities; those pilots with a reactionary take questioned the potential misuse of the technology. In a handful of cases, those skeptics proved to be correct—but for the bulk of the general aviation public, the result has been a net gain in both safety and utility. While the most recent statistics have shown an uptick in the fatal-accident rate (according to the most recent 2018 NTSB data), it’s premature to say more pilots have come to grief solely because of technology.
Say you’ve stumbled into IFR conditions or a situation in which you couldn’t fly your way out—we can all agree it’s better to learn your lessons by living to study the aftermath. And it’s the case even more that technology can save you from making those mistakes in the first place.
Autonomy refers to a state of being able to make choices and execute decisions as sovereign unto one’s self. Garmin’s Autonomi suite uses various tools to hand over that state to the airplane in an emergency situation—most likely when the pilot becomes incapacitated—and offers passengers an “out” they didn’t have before. The company has now introduced the key element: Autoland, the breakthrough system that allows those parts of Autonomi to not only escape the immediate hazard but also bring the airplane to a safe—and really quite-normal—landing.
Approaching Autoland
As a company, Garmin has created an environment within its walls where the testing of new ideas doesn’t necessarily need to go anywhere—so dreaming up the basic elements that would constitute the Autoland system for light aircraft fit right into the mix. But from the beginning, the engineers doing that forward thinking didn’t want their efforts to coalesce into just a “really great R&D project” and nothing else, and instead drove toward a system with broad practical application across several levels of aircraft types.
Bailey Scheel—senior aviation-programs engineer and manager at Garmin—grew up in Idaho, where she first learned to fly and where her family flew a Cessna 180 throughout the backcountry. Her excitement in joining the Autoland development team lies in its multifaceted nature: “The breadth of the project touches everything in the avionics, touches everything in the airplane—the radios, the transponder, the flight-control system, the [flight-management system], the displays—it touches everything,” she says. “There were definitely technical challenges in each of those areas, but just wrapping our arms around what it really was, was probably one of the more difficult things.”
The research into Autoland began in 2011; the first flight took place in May 2014. In September 2015, Garmin looped in the FAA, and in February 2016, it performed its first automated landing on an actual runway surface. Before that, all of the landings took place in the sky.
Jessica Koss is Garmin’s aviation-media-relations specialist and an experienced flight instructor, and she describes the process—which, to anyone familiar with Garmin’s creative side, makes perfect sense. “We’re very vertically integrated as a company, and part of that integration includes our own aviation database team,” Koss says, “so we actually built airports up in the sky—at 5,000 feet or what have you—and we would practice the approach to landing at altitude, the flare, the landing, all of that before we brought it down to the ground.”
In 2016, Piper Aircraft stepped up to the plate, eventually committing roughly $3 million in assets to the program, including test aircraft. “Over three years ago, I said, ‘I’m all in, whatever you need,’” says Piper president and CEO Simon Caldecott. “It’s a big advantage [for] our class of aircraft. We see more and more people who want to buy a seat in an airplane—and to know there’s a safety benefit.”
The platform of choice? The manufacturer’s flagship, the M600. Piper’s customers can fly the aircraft under BasicMed, as long as they keep operational weight to 6,000 pounds or less and stay below 18,000 feet. Not to suggest that those flying under that program are more likely to suffer a medical emergency; in fact, any one of us could fall prey to a sudden cardiac event or stroke.
But Caldecott and the Piper team identified a sweet spot inhabited by the M600 for the first implementation of Autoland—the bones of the airplane fit the project. The airframe’s big enough to have room to work with while putting into place all of the required components. It also had an option for a radar altimeter, which turned out to be important for the first application of the system.
Most pilots might think they would never use the Autoland function—and all companies involved in its debut hope they’re right. But Caldecott believes in the value of the system—what Piper has branded Halo—enough to envision that it will become standard on Piper’s full lineup of aircraft at some point in the future.
How Did I Get Into This?
Autoland engages under two separate conditions: when someone in the airplane, either the pilot or passenger, presses the guarded button or the system detects a lack of response from the pilot.
In the latter case, Koss describes two branches of the Autoland architecture based upon emergency functions already familiar to pilots using recent versions of Garmin’s series of flight decks. “The first scenario, think of it as your EDM scenario,” Koss says. “The pilot is flying straight and level [with the] autopilot on, at one of those hypoxic altitudes, and they don’t interact with the flight deck. They’re going to get that message, ‘Are you alert?’ and they just have to push any button on the flight deck [to answer the system’s query], and if they don’t, then EDM will descend [the airplane] to a lower altitude.” After a period of time, if the pilot continues to not interact with the flight deck or do anything, then Autoland activates.
The other automated scenario anticipates the need for aircraft recovery from a serious upset. Let’s say an inexperienced—or less-than-current—pilot gets into the clouds and starts banking really hard or pitching up aggressively or lowering the nose. “Then ESP will engage, and then again if ESP is engaged for a prolonged period of time…it will go into level mode,” Scheel says. If level mode is active for two minutes, and the pilot does not take the airplane out of level mode, then Autoland activates without further prompting from anyone in the airplane. “And that’s probably the more desirable condition for [the pilot and any passengers]—especially if you’re upside down and disoriented.”
All Elements In Place
When someone inside the airplane presses the button, Autoland immediately launches into its activation sequence. Two of the engineers behind its development describe each element of the process and how their work evolved to deliver the desired outcome: a reasonable landing at the most appropriate airport determined by the program. Eric Tran has been the primary senior software engineer, with the responsibility to develop the algorithm that constitutes Autoland “brains.” Ben Patel is team leader of aviation systems, heading up the cadre that has solved for solutions on the mechanical side. Both are listed on the original Garmin patent.
First, Autoland ensures envelope protection. The aircraft uses ESP to return to straight and level if needed.
Second, the system provides terrain protection. The team gave the example: What if Autoland engaged while the airplane flew below the ridgeline at Crater Lake in Oregon, where terrain on all sides creates an immediate hazard? The system would recognize that and enter a circling climb until clear of the terrain.
Third, Autoland moves to weather avoidance. “When you select the button, Autoland is going to take into account a lot of information, and it’s going to happen immediately,” Koss says. “It’s going to consider weather en route, weather at the destination—Autoland even has the capability to forecast weather” up to 15 minutes into the future. XM Nexrad data is updated every 2.5 minutes, and Autoland can use all of the sources, including Iridium and Flight Information Services–Broadcast, to request fresh data when able. If the system finds it necessary, Autoland can reroute to a more optimal airport.
Fourth, the system executes a route selection to the nearest appropriate airport. These calculations take place within 8 milliseconds, according to Tran. It also considers fuel on board, so it will select a destination within your fuel range. “Runway surface, length, width, type—all of that is taken into consideration. For the M600, the ideal runway length is 5,000 feet. We’ll accept 4,000 feet if that’s all that’s within range for us,” Koss says.
Choosing the airport: “We take apart the decision a pilot would make, and we narrow it down into these discrete buckets, [which include] attributes for a destination,” Tran says. “We can give each of these a score, and we can weight those, [in a configurable fashion] and for the [manufacturer’s] preference; it’s the preference for the airframe. If they tune it in a particular way, [the algorithm] can pick a longer runway and pick one that isn’t affected by crosswinds as much—but however they tune it, it’s going to be a safe selection.”
The Landing
“We collected the data, and it turns out that pilots don’t fly a glidepath perfectly down until they’re on the runway,” Patel says. “At some point, they decide, ‘That’s OK, close enough,’ and they actually dip below [the glidepath], typically, and flare up a little bit. So we had to look at some data and try to understand what makes sense and when we need to deviate from that geometry that we’d provided. We actually turned the problem into a little bit of a transition from a glidepath tracking to where we go into a mode where we’re simply trying to convert to vertical speed.”
Touchdown needs to be a bit firm. “The goal is not to feather it down but to be as comfortable as possible,” Patel says. “Once we get it down, [we want to] keep it on the ground.” That’s a steady vertical descent, as much nose-up as aerodynamically optimal, until the system is “confident” it’s on the ground. “Probably one of the hardest parts of the problem is knowing when you’re actually on the ground. We spent a lot of time just in the flight-test area really dialing in what is the right angle of attack, what is the right vertical speed target to get us on the ground.” The system also has to compensate for a wide variety of runway conditions, such as rain, ice or snow. On larger aircraft, these factors can be mitigated by a robust braking system, but on a light aircraft, it might not be cost-efficient or technically feasible.
But the truth is in the flying, so I took up Garmin’s invitation to come out and fly one of the M600 test aircraft in August 2019, before it returned to flight-test status and out of reach of aviation journalists vying for a preview. We took off from New Century AirCenter outside of Olathe, Kansas, and climbed up over the plains. Garmin flight-test pilot and engineer Eric Sargent sat in the right seat and walked through the activation. The control tower supervisor at New Century was somewhat in the know about what we were doing—but the automated calls to ATC were not part of the demo because they would instantly raise awareness of what the company had on the burner.
All was straightforward following activation—and we deactivated the system on our first attempt because of traffic vectored into the runway ahead of us. With a fully operational system, the airport normally would be cleared of conflicting traffic following the sequence of emergency radio calls triggered via Autoland. If a traffic conflict occurred, that’s a similar scenario to an encroachment made following a pilot’s own emergency call.
“I can tell you’re an instructor.” Sargent referred to the involuntary position of my hands below the yoke as we descended into the round out over the runway. True—I have grown accustomed over the years to restraining myself from smoothing out a student’s efforts in managing the touchdown, and I’ve learned to accept variations in technique (and contact with the runway) in order to allow for learning to take place. In this regard, Autoland looks to be a consistent performer. Our touchdown felt firm but secure, the kind of landing you would want on a slick runway to break any surface tension rain may have left behind. Sargent related that they had made more than 800 test landings at that point in the program.
We came to a stop on the runway, with the braking and steering mechanisms adjusting our rollout in a fairly smooth fashion. The engine did not shut down, but it would in the real activation. If we followed the instructions on the screens, we would exit the airplane on the runway and ostensibly be met by emergency personnel—shaken but not stirred.
Safe Return for Cirrus
Cirrus had the architecture for Garmin’s Autonomi system in mind for the Vision Jet from its inception and installed components of it on the airplane as they became available. The key to the final system capability was the addition of the autothrottle to the jet—without that, Autoland cannot perform its duties.
The Autoland program fits in neatly with Cirrus’ overall philosophy of taking what were unrecoverable accident chains in light aircraft, such as a midair collision or spatial disorientation, and crafting out-of-the-box ways to break those chains. The CAPS, for example, and the original primary flight display with a horizon-spoofing baseline. In the Vision Jet, the activation button is placed in the main cabin, well within reach of anyone in the passenger seats. This is key to the customizations made for Cirrus’ version of Autoland, which it has branded Safe Return.
Ben Kowalski, senior vice president of sales and marketing for Cirrus, has Garmin Aviation roots; he was its director of sales and marketing prior to arriving at the aircraft manufacturer. He envisions Autoland as a natural extension of the capabilities of both companies. “We see it being a pretty big deal because, in a passenger aircraft, this Autoland system can be activated [by someone] sitting anywhere in the aircraft…[it] turns it into an autonomous vehicle, and it’s making decisions to return to an airport like a pilot would. In the Vision Jet, you get to see the pilot [work], but now you get this enabling tool…I can press a button and bring it back to landing.”
Kowalski continues by making the direct link to the Cirrus philosophy. “If you have an airframe issue: CAPS. If you have a pilot incapacitation issue: Safe Return. We wanted to make sure that, if there’s a pilot incapacitation, the passengers can have access to the safety feature—Cirrus is trying to grow aviation.”
Todd Simmons, president of customer experience at Cirrus, explains further. “It all began with Garmin Perspective” and the inclusion of ESP and EDM—and the “smart” autopilot servos that drive those functions. “All of that integration…but it’s bigger than the technology. Collectively, we can harness them. We imagined [that would happen] when all the technology came together—autothrottle, autobraking and the key enabling technologies within the G3000.”
Standard on the Cirrus too? Yes, it will be a system on board in every single Vision Jet for now. And this is purposeful. “It changes the way single-engine pilot operations can happen. The stereotypical [worst-case] scenarios—it gives us a story to dispel those fears,” Simmons says.
On Final Final
Each aviation generation sees a handful of revolutionary concepts, those leading-edge technologies that, once introduced to the airplane, undergo a transition period—because they are so game-changing—before we fully understand the increase in safety they can provide. As certification progresses on the M600 and Vision Jet, training must take place—for both pilots and passengers—in order to maintain the level of safety that Garmin, Piper and Cirrus envision.
The first true activation of Autoland will come at some point in the future—just like the first deployment of CAPS following its introduction on the SR20 in late 1999. That incident didn’t occur until 2002, when a lone pilot who had departed Addison Airport in Texas aboard his SR22 deployed the chute following a loss of control, prompted by the separation of the left aileron from the airframe. It took three years, essentially, for the first use of the innovative system in an emergency. One person’s life—inarguably—was saved. Nearly 20 years later, we look for a similar outcome with Autoland.
This story appeared in the Jan/Feb 2020 issue of Flying Magazine
