Garmin Unveils System That Could Save Your Life

For the past eight years, Garmin has secretly been working on a fascinating new capability, an autoland function that can rescue an airplane with an incapacitated pilot or save a pilot when weather conditions present no other safe option. Autoland should soon receive its first FAA approval, with certification expected shortly in the Piper M600, followed by the Cirrus Vision Jet.

The Garmin Autoland system is part of Garmin’s Autonomi family of automation products, which includes Electronic Stability and Protection and Emergency Descent Mode. The Autoland system is designed to safely fly an airplane from cruising altitude to a suitable runway, then land the airplane, apply brakes, and stop the engine. Autoland can even switch on anti-/deicing systems if necessary.

Autoland is available for aircraft manufacturers to incorporate in their airplanes equipped with Garmin G3000 avionics and autothrottle. Piper Aircraft will make the system (branded Halo) standard in the new M600 SLS version of its single-engine turboprop. Cirrus is following suit with the Vision Jet, which will also offer Autoland (branded Safe Return).

More than 100 Garmin engineers worked on Autoland, including a team of human-factors experts. They had to carefully design the system so that a passenger can not only switch it on, but also understand what is happening during an Autoland event.

To learn more about the genesis of Autoland and how it works, I visited Garmin’s Olathe, Kansas, headquarters for a briefing and demo flight in the M600 with flight test pilot and engineer Eric Sargent.

The project began in 2011 with a Garmin engineer testing some algorithms that could make an autolanding possible, and in 2014 Garmin accomplished a first autolanding in a Columbia 400 piston single. In September 2015, Garmin got the FAA involved with the goal of certifying Autoland in production airplanes. So far, Garmin has flown more than 800 autolands in various airplanes, including about 200 in the M600, which made its first autolanding on September 10, 2018.

Emergencies Only

Sargent explained that Autoland is designed only for emergency use and not for pilots to use just because the weather is marginal or crosswinds too high or to prevent, say, a runway overrun for a pilot who isn’t confident about accomplishing a safe landing. The idea is “bad pilot, good airplane,” in other words, the pilot is no longer able to fly but the airplane is still operating normally and there is no other qualified pilot on board.

“I thought of my grandmother,” said Bailey Scheel, Garmin senior aviation programs engineer and manager. Although her grandmother has done pinch-hitter courses that teach non-pilots how to land in case the pilot has a medical issue, a safe outcome isn’t guaranteed. She added, “[Autoland] is more for her and her comfort.”

Another way to look at Autoland is that it gives aircraft manufacturers an alternative to a parachute-type rescue system for situations where the pilot is incapacitated and the airplane is still operating and given proper guidance, could land on a suitable runway. For Cirrus, Autoland adds the option of getting the airplane to a nearby airport where medical assistance may be more readily available, as opposed to deploying the parachute system over a remote area and hoping rescuers arrive in time.

Garmin can help aircraft manufacturers adapt Autoland to almost any airplane, and it could work on anything from piston singles to jets. The M600, for example, didn't have an autothrottle as standard equipment, but for Autoland, Garmin added an autothrottle, which is part of a new M600 SLS Halo-equipped version. An airplane that already has electronically controlled brakes will not need extra equipment, but the M600 did require the addition of servos and wheelspeed sensors to manipulate the brakes. “We can tailor it to the [manufacturer],” said Scheel. “It’s very configurable.”

In the M600 Autoland application, the system activates at 18,000 feet if the autopilot is engaged and the pilot doesn’t interact with the avionics in a 15-minute period. At higher altitudes, the engagement period is shorter. Autoland also tries to alert the pilot with repeated chiming sounds and asking, “Are you alert?” before engaging. Autoland will also engage if the Electronic Stability and Protection system is engaged for a prolonged period, first putting the M600 into level mode, and if the pilot doesn’t disengage level mode, then implementing an automatic landing. Even with a worst-case scenario of an incapacitated pilot and an engine failure, Autoland can improve the outcome by implementing a controlled descent to nearby smooth terrain. Autoland could also help rescue a pilot trapped by widespread zero-zero fog, allowing a safe landing where it would be difficult if not impossible to safely land using an ILS or LPV approach.

How Autoland Works

As a pilot flies along, Autoland is constantly looking at the weather, terrain, obstacles, and available airports, preparing for the rare case when it is activated.

In the M600, there is a prominent guarded Autoland button on the instrument panel. The Cirrus Vision Jet button will be on the overhead. All a pilot needs to do in terms of briefing passengers is tell them how to push the button.

When engaged, Autoland immediately turns the airplane toward the nearest suitable airport while showing on all three flight deck displays carefully designed messages that let the passengers know what is happening. A moving map on each PFD clearly illustrates the path that the airplane is taking to get to the selected airport. The PFD shows a split-screen with moving map on one side and synthetic vision system on the other. The MFD in the center shows messages for the passengers, as do the PFDs. One MFD message is an animation of the cockpit and the controls, with a warning: “Keep hands and feet away from aircraft controls.” Another explains in simple terms how to use the radio. On the displays at all times are the words: “Emergency autoland active” and “landing in XX minutes.” The MFD also shows how many miles to the destination and how much fuel remains in hours and minutes. Both PFDs show time until the next turn, if applicable, and time until descent.

A smoothly modulated voice tells passengers exactly what to expect.

At the same time, Autoland uses information about the state of the airplane to broadcast an emergency radio message on appropriate frequencies, and it resets the transponder to the 7700 emergency code. The radio broadcast might occur on the local approach control or control tower frequency. But if landing at a non-towered airport, Autoland will broadcast on the local CTAF frequency. These radio messages not only alert authorities to what is going on, but also warn pilots flying in the area that an emergency is underway and that after landing, the runway will be occupied by the automatically landing airplane.

As it flies the airplane toward the airport, Autoland slows it down and, if necessary enters a hold to bleed off excess airspeed. Passengers can communicate with controllers via radio if they wish, but it’s not necessary. Autoland helps by showing passengers how to make a radio call, using the Garmin touchscreen as a pseudo microphone button.

The airport must have a GPS approach with vertical guidance, and Autoland follows the approach precisely, lowering the landing gear and flaps at the correct time. As it nears the runway, Autoland reduces power and lines the airplane up with the centerline of the runway, then lands and applies brakes until the airplane stops. After stopping, it switches off the engine and instructs passengers on how to open the door. The reason it shuts off the engine is to prevent the possibility of a passenger running into a moving propeller.

Autoland offers a new way to ensure a safe outcome when a pilot becomes incapacitated for any reason, and it’s much easier for a non-flying spouse than learning how to land the airplane. If the pilot or passenger is unable to engage Autoland—say in a case where a pilot is flying alone and experiences oxygen deprivation—Autoland engages automatically after a certain period of time of pilot inactivity.

A pilot who recovers, perhaps after Autoland has descended to a lower altitude, can easily abort the Autoland procedure by pushing the autopilot button on the mode controller or the button on the yoke.

Real-time Demo

After taking off in the M600, Sargent climbed to about 4,500 feet not far from New Century Aircenter Airport so that the system would use that airport for the automatic landing. While cruising along, Sargent told me to push the Autoland button, which I did.

Immediately, the MFD in the center turned white, and big black letters spelled out “AUTOLAND” while a soothing female-sounding voice said “Emergency autoland activated. The emergency autoland system is controlling the aircraft and will land at the safest nearby airport. Please remain calm. Avoid touching the flight controls, which may interfere with Autoland. Your destination is…”

During the demo flight, the automatic radio broadcast was not active, to avoid declaring an emergency where none existed.

On the two touchscreen controllers below the MFD, which double as microphone buttons, the aircraft’s registration number is given (“Your aircraft ID is N60HL”) and a message says, “Informing air traffic control, please wait.”

Autoland eliminates much of the information shown to pilots on the PFDs and MFD to keep the messaging simple for passengers. Engine information, for example, is unnecessary. All the passengers need to know is what the MFD says at the bottom: “No action required” and on the PFDs: “Enroute to New Century Aircenter - Olathe, KS” and “Landing in 11 minutes.”

The PFDs show the flight path on the moving map, while the synthetic vision display retains the airspeed and altitude tapes as well as the flight director and attitude indicator.

Periodically, the MFD switches to a message instructing passengers how to contact ATC if they wish and reminding them that they will hear messages automatically broadcasted to ATC.

In our case, the M600 needed to lose some altitude, so it flew one turn in a hold before aligning with Runway 18. The MFD told us that we were “Approaching destination airport” and to put on seatbelts and stow loose items. The synthetic vision showed the reassuring sight of the runway straight ahead.

Autoland announced, “Your airplane has begun maneuvering into position for the final approach to landing. The emergency Autoland system is controlling all flight functions. You won’t need to do anything.”

The Autoland system set flaps to the approach setting then lowered the landing gear. Approach flaps are used in case of wing icing. Neither the flaps nor landing gear switches moved, so it was a little odd to be landing with the gear switch in the up position. But passengers will likely not notice this discrepancy, and it is much simpler than trying to explain to them how to manipulate the flaps and gear switches.

As the M600 neared the runway, it flew a perfectly stable approach and then reduced power and touched down by itself. It didn’t quite nail the centerline, but there was plenty of room on the runway. After touchdown, Autoland recentered the M600 on the centerline and braked to a full stop. It didn’t shut the engine down during the demo, but in a real autolanding it would have done so. Sargent had warned the tower that we would be stopping on the runway.

After landing, the system tells passengers to “Wait for aircraft and propeller to stop before exiting the aircraft,” then shows on the MFD how to open the door.

Flying an automatic landing in the M600 was fascinating, and it convinced me that this is a valuable addition to the safety toolbox. With Autoland, the era of losing airplanes because a lone pilot suffers hypoxia due to pressurization problems or lack of oxygen or loses consciousness because of a medical issue may finally end.