Category Three Autoland, the Triple-Redundant Autopilot That Flies an Airliner to Touchdown in Fog You Cannot See Through

Category Three autoland is a system that lets a transport jet fly all the way to touchdown - and steer down the runway afterward - in fog so thick the crew cannot see the pavement. It works by running three independent autopilot channels that constantly compare answers and outvote any channel that fails, guided by the runway’s radio beams and a radio altimeter that times the flare down to single feet. The result is a landing in weather that would be flat-out unlandable by hand, announced by nothing more than a soft chirp of the wheels.

What Is Category Three Autoland?

Picture fog on the field with runway visual range down to 300 feet. The airplane is in the flare, the crew still cannot see the concrete, and the jet lands itself anyway - smoothly, on centerline.

That is Category Three (Cat III) autoland: the moment where cockpit automation stops being an assistant and becomes the pilot flying the touchdown. The reason the autopilot is landing the airplane is not that the crew can’t. It’s that the outside world has disappeared into fog, and the machine can hold a tighter, more repeatable path to the pavement than human eyes can when there is nothing to see.

How Is Autoland Different From Garmin Autoland?

These systems share a name and almost nothing else.

Garmin Autoland is an emergency system that lands a light airplane by itself when the pilot is incapacitated - one button, no hands on the yoke, a safety net for a cockpit where the human has stopped flying.

Category Three autoland is the opposite situation. The crew is fully awake, fully trained, and hands-ready. The airplane is a transport jet. The autopilot flies the landing because the visibility is gone, not because the pilots are. Same word, completely different engineering problem.

What Do the ILS Categories Mean?

The categories come from the Instrument Landing System (ILS) and describe how low the weather can get before you are allowed to keep descending. Two numbers matter: the decision height (where you either see enough to land or go around) and runway visual range (RVR), a measured value of how far you can see down the runway.

Category One: decision height around 200 feet, visibility roughly half a mile. Hand-flown or autopilot-assisted; the pilot must see the runway environment to continue.
Category Two: down to about 100 feet, with RVR near 1,000 to 1,200 feet.
Category Three: where the automation becomes the pilot flying.

Category Three splits into three grades:

Cat IIIA: down to about 50 feet with RVR near 700 feet.
Cat IIIB: RVR as low as 150 to 300 feet, with essentially no usable decision height.
Cat IIIC: zero visibility - the theoretical case you almost never see in the real world, where you could taxi, take off, and land without ever seeing the ground.

The key point most people miss: at Cat III minimums, there is no moment where a human looks up, spots the runway, and takes over. There isn’t time and there isn’t visibility. The airplane is committed to letting the autopilot fly all the way to touchdown - and in the higher grades, to steer down the runway after the wheels are on the ground.

Why Redundancy Is the Real Story

Handing the touchdown to a box of electronics is a staggering amount of trust. The real story of autoland is not the landing - it’s the redundancy that makes that trust rational.

Consider what happens if a normal autopilot quits at 50 feet in thick fog. On a clear day you grab the controls and land. In Cat III fog, a sudden disconnect at 50 feet with no visual reference is an emergency. So the entire philosophy is built around one question: what happens when a piece fails at the worst possible moment?

Engineers answer with two design philosophies:

Fail-passive: if the system breaks, it lets go cleanly - no sudden pitch, no roll, no hard control input. It hands the airplane back wings-level on a sensible path and announces the failure, and the crew flies a go-around. This is the standard behavior behind Cat IIIA.
Fail-operational: the system can suffer a failure and keep flying the approach to touchdown as if nothing happened. One channel dies, the others carry the airplane down. This is the capability behind Cat IIIB, where visibility is so low that a go-around from 50 feet is itself a serious maneuver.

How Does the Triple-Redundant Autopilot Work?

To build fail-operational, you build the autopilot three times over. The classic transport-category autoland uses triple redundancy: three independent autopilot channels, each with its own computing, each reading the localizer and glideslope, each watching the radio altimeter, all flying the same approach in parallel.

They constantly compare notes and vote. If one channel produces an answer that disagrees with the other two, the majority outvotes it, flags it as faulty, and drops it from the calculation. The airplane keeps flying on the two that agree - democracy at two hundred knots, resolved dozens of times a second.

That same voting architecture shows up across aerospace: flight control computers, space launch vehicles, anywhere the cost of a single silent failure is measured in lives.

What Sensors Guide the Airplane in Fog?

Down the approach, the airplane rides two radio beams from the ground:

The localizer gives left-right guidance to runway centerline.
The glideslope gives the vertical path down to the touchdown zone, typically a three-degree slope.

The autopilot keeps both needles centered with a steadiness no human wrist can match - it never tires and never over-corrects into a chase.

Then, in the last hundred feet, a different sensor takes over the most delicate part of the maneuver: the flare, the gentle raising of the nose that turns a descent into a soft arrival. To flare on time, the airplane must know its exact height above the ground down to single feet. The barometric altimeter is useless for this - it doesn’t know where the runway surface is.

So the airplane uses a radio altimeter, bouncing a radio signal straight down and measuring the echo’s return time for true height above the surface. As the airplane crosses 50 feet, then 40, then 30, that height feeds the autopilot, and at the right moment the system commands the flare, eases the descent, retards the throttles, and settles the main wheels onto pavement it has never seen.

This is why the radio altimeter drew so much attention when interference from nearby wireless frequencies became a concern, prompting a fleet-wide fix driven by the Federal Aviation Administration (FAA). In a Cat III autoland, the radio altimeter is not a nice-to-have - it is the sensor that decides when the airplane lands.

Why the Ground Matters as Much as the Airplane

Autoland is not just an airplane capability - it is a system that includes the ground.

The field’s ILS must be a higher-integrity installation, monitored and certified for the low categories. The space around the antennas - the critical area and sensitive area - has to be protected. A large metal object, a taxiing airplane, or even a vehicle parked in the wrong spot near the localizer antenna can bend the radio beam slightly. On a clear day you’d never notice. During a Cat III approach, a bent beam is a bent flight path toward the touchdown zone.

That is why, when weather drops to low-visibility minimums, the tower switches into low visibility operations: stopping traffic short of the protected zones, increasing spacing, and guarding the beam. The airborne automation gets the credit, but it only works because ground procedures hold the electromagnetic environment perfectly still underneath it.

What Has to Be True to Fly a Cat III Autoland?

Four things must all be true at once:

The airplane is certified and equipped, with its redundant autopilots working.
The ground ILS is certified for the category and running clean.
The airport is in low visibility procedures with critical areas protected.
The crew is trained and current for it.

Miss any one, and your minimums climb right back up.

Where Did Autoland Come From?

The pioneers were the British. After the war, fog routinely shut English airfields for days, and the Blind Landing Experimental Unit set out to solve it - not with better pilot training, but with automation. Through the 1950s and 1960s, they flew thousands of automatic approaches, refining the sensors, the control laws, and, critically, the failure behavior.

The airplane that carried it into airline service was the Hawker Siddeley Trident, a three-engine British jet that flew the world’s first automatic landings with fare-paying passengers aboard in the mid-to-late 1960s. Passengers in the back, fog on the field, and the airplane landing itself at a time when the transistor was still young.

Everything we fly today with an autoland button traces back to that work - roughly 60 years of refinement. The core idea, redundant channels flying radio beams to an automatic flare, has barely changed. It just got more reliable, cheaper, and lighter.

What Are the Pros and Cons of Autoland?

The upside is about safety and schedule. Autoland gives an airplane a way into an airport in weather that would otherwise be unlandable, and it does so with a steadiness that removes a whole category of human error from the riskiest sixty seconds of flight. On a foggy winter morning at a major hub, it’s the difference between an on-time arrival and a planeload of people diverting hundreds of miles away.

But it is not magic. The requirements are demanding and expensive - not every runway has a Cat III ILS, not every airport runs low visibility operations, and the redundant airborne equipment costs real money and maintenance. That’s why full Cat III capability concentrates on transport jets and major airports, and almost never on light general aviation.

Autoland is also intolerant of anything out of place. Crosswinds beyond the certified limit, a NOTAM saying the glideslope is out of service, or a vehicle straying into the critical area at the wrong moment can each take the approach off the table. The system is precise precisely because it demands a clean, controlled environment.

There’s a subtler cost too: when automation is this good this often, pilots can slowly lose the raw hand-flying proficiency they still need on the day the automation isn’t available. That’s not an argument against autoland - it’s an argument for deliberately practicing manual skills, which the best operators build back into training on purpose.

What’s Next for Precision Landing Guidance?

Classic ILS autoland is mature technology, in daily airline service for half a century. The interesting movement now is in what supplements or replaces the ground radio beams.

The big shift is satellite-based guidance built on the Global Positioning System (GPS), augmented for precision:

A ground-based augmentation system (GBAS) broadcasts correction data from the airport, so a single installation can serve precise approaches to multiple runway ends - no forest of ILS antennas and fragile critical areas.
Satellite-based augmentation feeds approaches with vertical guidance almost everywhere, even at small fields that could never afford an ILS.

The direction of travel is clear: fewer delicate ground beams, more precise and flexible satellite-driven guidance that can bring low-visibility capability to airports that never had it. The cockpit automation - the redundant autopilots and the automatic flare - stays much the same. What’s changing is the source of the guidance it flies.

Some of the most profound automation in aviation is 60 years old, sitting quietly in every airliner, announcing itself with nothing more than a soft chirp of the wheels in weather where you never saw the runway at all. That is what mature automation looks like - not flashy, just trustworthy, ten thousand times a day.

Key Takeaways

Category Three autoland flies a transport jet all the way to touchdown in fog too thick for the crew to see the runway, with grades IIIA (≈50 ft, RVR ≈700 ft), IIIB (RVR 150–300 ft, no usable decision height), and the theoretical zero-visibility IIIC.
Reliability comes from triple-redundant autopilot channels that vote and outvote any failed channel, delivering fail-operational performance for the lowest minimums.
The radio altimeter is the critical sensor for the flare, measuring true height above the runway down to single feet - which is why interference concerns prompted an FAA-driven fleet fix.
Autoland depends on the ground as much as the airplane: a certified ILS, protected critical areas, and tower low visibility operations all have to be in place.
The technology dates to the British Blind Landing Experimental Unit and the Hawker Siddeley Trident’s first passenger autolands in the mid-to-late 1960s, and is now evolving toward GPS-based GBAS and satellite augmentation.