Narrative:

Aircraft X had an open write-up (MEL) asking us to perform an autoland due to multiple 'no autoland' alerts. We briefed and executed a coupled approach to an autoland at ZZZ xxr with flaps 50. We informed approach we were doing an equipment check. Wind was 240/7. Preceding aircraft cleared the runway when we were about 5 mile final. There appeared to be no interference with the ILS system. Aircraft and autopilot performance to 50 feet was normal (dual land; align maneuver etc.) I was guarding the yoke and throttles during the approach.at approximately 40 feet the aircraft started a normal flare with auto throttles retarding. HUD indications were normal with the flare cue exactly aligned with the flight path vector to about 20 feet. I remember thinking this was 'looking good.' at approximately 15-20 feet the autopilot aggressively de-rotated the aircraft creating an excessive sink and a minus 5 degrees flight path vector HUD picture. I believe the yoke traveled about 4 inches forward in a matter of a few seconds during this de-rotation. I immediately tried to disconnect the autopilot and while applying back pressure to the yoke; while simultaneously applying max power to prepare for a hard landing. I am not sure I was successful disconnecting the autopilot. I called for a go-around at some point.we landed hard twice; ballooned twice and I believe the nose gear struck the runway at least once; perhaps twice while I was attempting to disconnect the autopilot and execute a go-around. I maintained max power throughout the balloon and porpoising of the aircraft and eventually was able establish a normal 60/40 sight picture and get the aircraft climbing away from the around. I believe I was able to get the autopilot disconnected at some point but I also recall countering autopilot inputs during the bounce/ballon/porpoise cycle. This was a classic startle event; even though I had briefed situations where I would disconnect the autopilot and was monitoring it closely I have never seen and MD11 autopilot make such a large downward control input that close to the ground. This was an extremely dangerous malfunction of the autopilot.during climbout we started the go-around callouts; clean-up but during our level off we overshot our assigned altitude of 3;000 feet by about 800 feet. I believe we were extremely distracted and startled by our near death experience and it took us a while to regain our flows and callouts and composure. We received vectors back to a visual hand flown capt landing on xxl ZZZ. I noticed during landing that the winds around the touchdown zone were more of a tailwind than what tower was calling as we floated a little longer than normal. That's just a seat of the pants estimate but we both noted that aspect. I completed a [maintenance] write-up for the hard landing the autopilot malfunction and contacted the duty officer per the fom. The flight summary g showed 1.2 g but I believe that was from my last landing not the hard landing(s).I believe the auto flight system malfunctioned at a critical time. It seemed as if the system thought the aircraft was on the ground and was de-rotating the nose after landing when in fact it was still 20 feet in the air when it de-rotated. I had my finger over the top of the autopilot disconnect button but the abrupt auto-pilot downward yoke input may have caused me to miss the button and I naturally started applying yoke back pressure fighting the autopilot inputs to attempt to regain a 7.5 degree sight picture for the hard landing. Altitude bust on departure was due to task saturation; emotional distraction of almost dying a few minutes earlier.I wish I was able to get the autopilot off quicker. What I did right was aggressively applied and held max power and called go-round and I believe that saved us as we eventually gained airspeed and stopped the bounce balloon porpoise cycle. If I hadn't I think we would have porpoised into the nose gear and crashed and you'dbe attending our funeral. We need to train for autopilot malfunctions during an autoland. Especially malfunctions close to the ground. I received no training on this in the school house but I believe the runway safety training I received saved our lives just need to add the autopilot aspect to that training.

Google
 

Original NASA ASRS Text

Title: MD-11 flight crew reported malfunctioning autoland that caused the aircraft to pitch down sharply while still in the flare.

Narrative: Aircraft X had an open write-up (MEL) asking us to perform an autoland due to multiple 'no autoland' alerts. We briefed and executed a coupled approach to an autoland at ZZZ XXR with flaps 50. We informed approach we were doing an equipment check. Wind was 240/7. Preceding aircraft cleared the runway when we were about 5 mile final. There appeared to be no interference with the ILS system. Aircraft and autopilot performance to 50 feet was normal (dual land; align maneuver etc.) I was guarding the yoke and throttles during the approach.At approximately 40 feet the aircraft started a normal flare with auto throttles retarding. HUD indications were normal with the flare cue exactly aligned with the flight path vector to about 20 feet. I remember thinking this was 'looking good.' At approximately 15-20 feet the autopilot aggressively de-rotated the aircraft creating an excessive sink and a minus 5 degrees flight path vector HUD picture. I believe the yoke traveled about 4 inches forward in a matter of a few seconds during this de-rotation. I immediately tried to disconnect the autopilot and while applying back pressure to the yoke; while simultaneously applying max power to prepare for a hard landing. I am not sure I was successful disconnecting the autopilot. I called for a go-around at some point.We landed hard twice; ballooned twice and I believe the nose gear struck the runway at least once; perhaps twice while I was attempting to disconnect the autopilot and execute a go-around. I maintained max power throughout the balloon and porpoising of the aircraft and eventually was able establish a normal 60/40 sight picture and get the aircraft climbing away from the around. I believe I was able to get the autopilot disconnected at some point but I also recall countering autopilot inputs during the bounce/ballon/porpoise cycle. This was a classic startle event; even though I had briefed situations where I would disconnect the autopilot and was monitoring it closely I have never seen and MD11 autopilot make such a large downward control input that close to the ground. This was an extremely dangerous malfunction of the autopilot.During climbout we started the go-around callouts; clean-up but during our level off we overshot our assigned altitude of 3;000 feet by about 800 feet. I believe we were extremely distracted and startled by our near death experience and it took us a while to regain our flows and callouts and composure. We received vectors back to a visual hand flown Capt landing on XXL ZZZ. I noticed during landing that the winds around the touchdown zone were more of a tailwind than what tower was calling as we floated a little longer than normal. That's just a seat of the pants estimate but we both noted that aspect. I completed a [maintenance] write-up for the hard landing the autopilot malfunction and contacted the duty officer per the FOM. The flight summary g showed 1.2 g but I believe that was from my last landing not the hard landing(s).I believe the auto flight system malfunctioned at a critical time. It seemed as if the system thought the aircraft was on the ground and was de-rotating the nose after landing when in fact it was still 20 feet in the air when it de-rotated. I had my finger over the top of the autopilot disconnect button but the abrupt auto-pilot downward yoke input may have caused me to miss the button and I naturally started applying yoke back pressure fighting the autopilot inputs to attempt to regain a 7.5 degree sight picture for the hard landing. Altitude bust on departure was due to task saturation; emotional distraction of almost dying a few minutes earlier.I wish I was able to get the autopilot off quicker. What I did right was aggressively applied and held max power and called go-round and I believe that saved us as we eventually gained airspeed and stopped the bounce balloon porpoise cycle. If I hadn't I think we would have porpoised into the nose gear and crashed and you'dbe attending our funeral. We need to train for autopilot malfunctions during an autoland. Especially malfunctions close to the ground. I received no training on this in the school house but I believe the runway safety training I received saved our lives just need to add the autopilot aspect to that training.

Data retrieved from NASA's ASRS site and automatically converted to unabbreviated mixed upper/lowercase text. This report is for informational purposes with no guarantee of accuracy. See NASA's ASRS site for official report.