Garmin’s Autoland: Testing The Threshold Of Type Certification

By now almost everyone in aviation has heard of Garmin’s Emergency Autoland. If you missed our flight trial video, here it is again. Generally jaded by new avionics, you’ll tell by my expressions in the footage that Garmin’s Emergency Autoland is a remarkably well-executed third layer of automated backstop in what’s called Autonomi. More than seven years in the making by a talented team measured in hundreds, fly with Autoland and it’s impossible not to feel respect for Garmin’s achievement.

Although if anyone can do it, I’d expect Garmin would, given its record for dishing out new products by the hour. But let’s tamp this announcement down some and look beyond the shock, awe and the sappy product advertising clips, shall we? There’s a series of bigger stories getting lost in the celebration—from aircraft sales to insurance matters. 

Impressive, yes, but Autonomi Emergency Autoland means more for the future than for the present. That’s kind of cliché, but we can no longer say someday the airplane will land itself down with the push of a button, or even without the push if the pilot can’t even muster that effort.

This tech to me screams that in the not-too-distant future you’ll likely climb into the left seat, program the FMS to fly to the planned destination and cross your arms while the automation does the rest, just as the system does now for the en route, approaches and landings portion. I can’t think of many technical obstacles in the way of that, except the FAA’s signature on the type certificate.

Garmin, Piper and Cirrus haven’t discussed the certification process at any length, but I sense there have been obstacles trickled down from the Boeing MAX investigation. If you’ve been reading the coverage, you can plainly see the crisis hasn’t abated. In that sense, the timing of Garmin’s Autoland rollout couldn’t be worse. For a while, Garmin initially chose not to announce the system before it was officially written on the $2.994 million Piper M600 SLS type certificate. As it stands now, it’s close enough and reason to clap. But it hasn’t been an easy go and the FAA could have said no to the mere premise of a system that lands the airplane. But it didn’t.

For a while, we were cruising with a certification tailwind— experimental products given the FAA nod without having to do a budget-draining TSO. This is the case with Garmin, Dynon and Aspen EFIS, plus autopilots, at a sizable decrease in the retail price. I wonder if this liberal approval tone around the FAA office got Autoland as far as it did. Still, the Autonomi suite has high-level software as you’d expect. I’m not so sure any certifications for autonomous systems will be easy moving forward, and Garmin’s Autoland is testing the thresholds of FAA type certification.

As I write this, Autonomi Autoland isn’t certified (the supporting layers in the G3000 avionics are)—Piper is still in the late stages of type certificate flight testing. More challenging is that the fly-offs are generally out of Garmin’s own regular channels of certification. Instead, it’s up to the aircraft manufacturer to bring its aircraft to the governing FAA region for proving and hopefully to earn a type certificate that encompasses Garmin’s Autoland (in this case Piper’s M600 SLS and Cirrus’ Vision Jet).

I asked Garmin the other day when it expects the Piper M600 to have a type certificate and it said certification is imminent. Still, I long ago learned to never rely on certification dates, partly because of government office hours. But something’s a little different here.

Is there tap-the-brakes caution in play because of the Boeing thing? Maybe, and that hasn’t been good for Piper or Cirrus, who surely want to close deals on Autoland and Cirrus Safe Return-equipped airplanes. Autonomi Autoland has got to be the biggest marketing buzzword in the history of the aircraft sales market. Even though the chance of this system being used in real numbers is slim. To be clear, deploying Autoland is a full-up 7700 emergency, confessed on the comms for traffic-clearing immediate priority ATC handling, and it’s not intended otherwise.

It can be overridden via autopilot disconnect. Without sifting through the wreck reports, it’s easy to suggest that pilot incapacitation is relatively rare, although there have been fatal hypoxic events in airplanes you’d least expect, and likely enough good outcomes that might have been fatal that we haven’t heard about. Still, for someone with the means to write a check for a $3 million airplane that already has layers of autopilot envelope protection, I’m not sure Autoland will sway the decision either way. Then again, it might for some, just for bragging rights.

Garmin’s Phil Straub sees it differently. He told me the company had a duty to bring Autoland to market in the name of passenger safety because it could. No matter the intent, Garmin deserves a tip of the hat for even venturing into and sticking with the Autoland product. Think of the enormity of the project, especially the software code. Even though it already had a lot of the supporting Autonomi hardware and software in place—mainly autopilot and autothrottle tech—it’s obviously a huge corporate investment that includes sizable risk because, well, avionics can fail, and the airplane could make a smoking crater even if it’s not at fault.

Maybe there’s a collision with another aircraft on the runway at an uncontrolled field, despite its radio calls. Maybe a passenger freaks out and ham-fists the controls or maybe the pilot is slumped over into the controls and interferes. Garmin should add that one to its silky smooth passenger briefing: “Pull dead pilot off yoke.”

If the aircraft had an engine failure (or ran out of fuel) on the way to the destination, Garmin can’t help by adding more fuel. Autoland is designed for a functional airplane, but the autopilot’s Underspeed Protection (USP) would kick in and control the aircraft speed to remain above stall while descending. The airplane would likely land off-airport, probably in a flat configuration with the gear up. It could also theoretically have a midair—more of a chance for that at an uncontrolled field, I suppose. The algorithm favors towered airports for obvious reasons.

Speaking of risk glossed over by the ultimate marketing tool, Jackie Carlon at Piper told me that the M600 is already appealing to some older pilots who fly under BasicMed certification. They’d have to fly the airplane low to comply with BasicMed limits, which probably makes the M600 the wrong airplane, but Carlon reasoned that families of these older pilots would see the value in an airplane that can land itself should grandpa check out behind the controls. She’s right, of course, and this got me thinking about the hardened insurance market that’s clobbering owners—especially aging ones—who fly their own turboprops or jets.

I asked Jon Doolittle at Sutton James Aviation Insurance Brokers in Connecticut if he thought insurers would offer discounts for policyholders who own an Autonomi Autoland airplane. After asking if the thing will fly to the nearest cardiac center, Doolittle said, “Discounts is not a word anyone in the aircraft insurance underwriting world understands right now.” Makes you want to run out and buy a jet, no? 

Oh, and for the conspiracy theorists who are convinced the landing footage in our Autoland video was shot in a flight simulator, thanks for the amusement (I needed it), but rest assured it was not a sim. Look carefully and you’ll see the blazing Kansas summer sun on the control yokes when I shot the footage last June. The over-the-shoulder landing B-roll was shot by a back seater with my gyro stabilized iPhone. My sense is the M600’s heated windshield and lack of prop filter on the camera made it look artificial. You can plant your eyes on more real-world Autoland footage in a Cirrus Jet flight report in an upcoming video here at AVweb and at sister publication Aviation Consumer.