Information and display requirements for independent landing monitors

The ways an Independent Landing Monitor (ILM) may be used to complement the automatic landing function were studied. In particular, a systematic procedure was devised to establish the information and display requirements of an ILM during the landing phase of the flight. Functionally, the ILM system is designed to aid the crew in assessing whether the total system (e.g., avionics, aircraft, ground navigation aids, external disturbances) performance is acceptable, and, in case of anomaly, to provide adequate information to the crew to select the least unsafe of the available alternatives. Economically, this concept raises the possibility of reducing the primary autoland system redundancy and associated equipment and maintenance costs. The required level of safety for the overall system would in these cases be maintained by upgrading the backup manual system capability via the ILM. A safety budget analysis was used to establish the reliability requirements for the ILM. These requirements were used as constraints in devising the fault detection scheme. Covariance propagation methods were used with a linearized system model to establish the time required to correct manually perturbed states due to the fault. Time-to-detect and time-to-correct requirements were combined to devise appropriate altitudes and strategies for fault recovery.