Fail-Passive, Fail-Operational
Disclaimer:
▪︎This content is Not an official document and does not represent the views of Airbus or any other aviation authority.
▪︎The information provided may be incorrect or misinterpreted and should not be relied upon for decision-making.
▪︎Always refer to official documents and consult with a qualified aviation professional before making any decisions based on the information provided in this blog post.
▪︎The information provided in this blog post is based on personal study and review.
The primary difference between a fail-operational automatic landing system and a passive automatic landing system lies in their behavior during a failure.
• Fail-operational system: In the event of a failure during the landing sequence (such as the failure of one autopilot), the fail-operational system can still complete the automatic landing by relying on redundant systems. This ensures that the landing can proceed safely even if a system component fails.
• Passive system: This system lacks redundancy for such failures. If a failure occurs, the system does not compensate, and the pilot must take over control manually to complete the landing.
Essentially, the fail-operational system provides higher reliability by allowing the autopilot to handle a failure, while the passive system requires pilot intervention in case of issues during landing.
• Fail-operational: “In the event of failure below alert height.” This means the system will continue to perform an automatic landing even if a failure occurs below the critical alert height, as it has redundancy in place.
• Fail-passive: “In the event of a failure, not significant out of trim.” This means the system cannot continue the landing automatically after a failure. The failure will not result in a major out-of-trim condition, but the pilot will have to take over and complete the landing manually.
These keywords capture the essence of how each system reacts to failures during landing.
