The Category Three ILS, the Triple-Redundant Autoland System That Votes On Its Own Decisions, and the Touchdown You Execute Without Ever Seeing the Runway

Category III ILS autoland is the most automated procedure in commercial aviation, allowing airliners to land with runway visual range as low as 300 feet - conditions where the flight crew may never see the runway before the main gear touches down. The system relies on at minimum three independent computers that continuously cross-check each other’s outputs and vote on every control surface command between the outer marker and touchdown. Understanding its architecture explains why it works, where it occasionally fails, and why it represents a fundamentally different philosophy of flight operations than anything that came before.

What Do the ILS Categories Actually Mean?

The Instrument Landing System categories define the minimum visibility conditions under which a landing may be attempted, and they impose escalating requirements on the aircraft, crew, and airport infrastructure.

Category I requires a 200-foot decision height and 2,400 feet of runway visual range - roughly half a mile. Most pilots train to Cat I and fly it regularly. At decision height, the crew must see the runway environment to land.

Category II lowers the floor to a 100-foot decision height and 1,200 feet of RVR. Automation requirements increase significantly: the aircraft must have a fail-passive or fail-operational autopilot, crew training and currency requirements are stricter, and both the runway and the airline must hold specific Cat II certifications.

Category III is where the engineering becomes genuinely consequential. It breaks into three sub-categories:

Cat IIIa: Decision height below 100 feet, down to 50 feet; RVR as low as 700 feet
Cat IIIb: Decision height below 50 feet - sometimes 15 feet, sometimes zero - with RVR as low as 300 feet or 150 feet
Cat IIIc: Zero decision height, zero visibility; the regulatory framework exists, but as of 2026, no runways are certified and no commercial operators are authorized in the United States

Cat IIIb is the operational benchmark. At 300 feet of RVR, approach lighting may not be visible until the aircraft is already on the ground. The system must land the airplane.

Fail-Passive vs. Fail-Operational: Why the Distinction Matters

Most people understand that autoland involves automation. Fewer understand that “autoland” describes two meaningfully different system architectures - and that the difference determines which minimums you can legally fly.

A fail-passive autoland uses two independent computers. If one disagrees with the other during the approach, the autopilot disconnects and the crew completes the landing manually. The system hands control back rather than doing something wrong. At Cat II minimums with 100 feet of altitude and some runway environment visible, a trained crew can handle that transition.

A fail-operational autoland uses three independent computers. If one fails mid-approach, the remaining two continue and complete the autoland. The system absorbs a failure without interrupting the procedure. This is required for Cat IIIb operations - by the time a computer failure occurs, there may be no visual reference available for a manual landing and no altitude for a safe go-around.

On the Airbus A320 and A330 families, the flight mode annunciator displays either LAND 2 or LAND 3 as the system enters autoland mode around 1,500 feet. LAND 3 means all three computers are healthy: fail-operational, Cat IIIb capable. LAND 2 means one computer has been lost: fail-passive only. Dropping to LAND 2 below 1,000 feet on a Cat IIIb approach is a go-around. The procedure does not leave room for judgment calls.

How Three Computers Vote on Every Control Input

The architecture behind fail-operational autoland is called triplex redundancy. Each of the three computers runs the same algorithms, processes the same sensor inputs, and independently generates its own set of control commands - continuously, dozens of times per second.

The computers then compare outputs. If all three agree within a specified tolerance, the averaged command goes to the flight control surfaces. If one computer’s output deviates significantly from the other two, the majority outvotes it: the disagreeing computer is flagged and set aside, and the remaining two keep flying. If two computers disagree, the approach ends in a go-around.

This voting architecture also appears in fly-by-wire flight control systems - which is part of why autoland became standard on fly-by-wire aircraft before it became standard on mechanically controlled ones. The computational infrastructure was already in place.

From Outer Marker to Touchdown: The Autoland Sequence

Above roughly 1,500 feet, the autopilot flies a standard coupled ILS approach - localizer and glideslope tracking - but is not yet in autoland mode. The LAND 2 or LAND 3 annunciation marks the transition to active autoland architecture.

From approximately 50 feet above the runway, the system begins the flare. The trigger is the radio altimeter, not the barometric altimeter. The radio altimeter pings the ground directly below the aircraft and returns a precise height above terrain. The flight computers use that input to initiate a calculated pitch increase that arrests the descent rate and converts the glideslope profile into a soft touchdown - a gradual attitude change, not a dramatic pullback.

Throttle management runs simultaneously. On Airbus aircraft, autothrust transitions to retard mode at approximately 20 feet of radio altitude. The electronic callout “Retard” prompts the pilots to bring thrust levers to idle if autothrust has not already done so.

At touchdown, the autopilot typically disconnects and the autobrake system manages rollout deceleration. On Cat IIIb operations, the crew takes over when the runway becomes visible or the rollout is complete. Throughout the procedure, the pilots monitor and are prepared to intervene - but for the autoland sequence itself, their hands are not on the controls.

Why This Matters for Pilots: The Monitoring Problem

This is the part of Cat III operations the technical architecture understates. The autoland system is highly reliable. The human task of supervising it is not straightforward.

Sustained vigilance for a system that almost never fails is one of the hardest cognitive tasks in any high-stakes domain. When nothing demands attention, attention drifts. Aviation is not unique in this: nuclear plant operators watching stable systems, air traffic controllers covering quiet sectors, highway drivers on long empty stretches all face the same documented problem.

The FAA, EASA, and IATA’s low-visibility operations working group have all published guidance on this specifically. The accidents that have occurred during low-visibility operations tend not to involve the autoland system itself failing. They tend to involve failures in crew monitoring, failures to recognize when system degradation makes the approach inadvisable, and failures at the handoff from automation to manual control when something unexpected occurs late in the approach.

Simulator training maintains procedural currency but cannot fully replicate breaking out below 1,000 feet of RVR into a fog-shrouded approach environment with nothing outside the windshield. That sensory gap between simulator procedure and actual low-visibility environment is a documented human factors concern - and the research on it remains ongoing.

A Brief History of Autoland

This technology did not arrive with fly-by-wire. It has nearly six decades of operational history.

The first certified blind landing in commercial passenger service occurred in June 1965. A British European Airways Hawker Siddeley Trident - a three-engine jet designed for the European market - made the first automatic landing approved for regular service. The system was called Autoflare. British engineers had been developing it specifically for London Heathrow’s recurring autumn and winter fog since the late 1950s.

By 1968, British European Airways was operating regular Cat II autoland procedures. By 1972, they had Cat III certification - nearly 20 years before the Airbus A320 flew its first flight. The Concorde, the Boeing 747, and the Douglas DC-10 all received autoland certification before the fly-by-wire generation arrived.

By the time modern fly-by-wire aircraft entered service in the 1980s, the operational experience base was already two decades deep. What fly-by-wire added was computational power, integrated sensor fusion, and envelope protection - not the fundamental concept.

How Often Is Autoland Actually Used?

Less often than the capability would suggest.

True Cat IIIb approaches - where RVR falls below 600 feet and autoland is not optional - represent a very small fraction of airline operations globally in any given year. Dense radiation fog at a certified Cat IIIb airport is a specific combination that occurs infrequently at most hubs. Most line pilots fly only a handful of actual Cat IIIb approaches in a career. London Heathrow, Beijing Capital, and certain northern European airports see it more often than Phoenix, Dallas, or Atlanta, where the conditions rarely develop.

The consequence is a persistent training challenge. Simulator sessions maintain procedural currency, but operational exposure to actual low-visibility environments remains limited for most crews. The industry has been working on this problem for decades without a clean solution.

Infrastructure Requirements: The Constraint No Aircraft Can Override

A Cat III-capable aircraft at a Cat I airport cannot fly a Cat III approach. The limitation is the ground infrastructure, not the airplane.

Cat III certification requires ILS transmitters meeting tighter specifications than Cat I equipment. Critical areas around the localizer and glideslope antennas must remain clear of ground vehicles and taxiing aircraft during approaches in progress - any intrusion can distort the signal. Runway lighting intensity and spacing, surface movement protocols, and hold-short procedures all serve to protect the signal environment.

At many major airports, only one runway in one direction carries full Cat III certification. This is a real operational constraint when low-visibility conditions arrive.

Ground-Based Augmentation Systems (GBAS) - which use ground-station networks to improve GPS accuracy to ILS precision - have attracted significant investment as a structural alternative. Certified GBAS operations are in place at Brisbane, Newark, Frankfurt, and Sydney, among others. But global rollout has been slow; the ground equipment investment remains substantial.

What Comes After ILS?

Several research programs are pursuing precision approach capability that does not depend on fixed ground transmitters. LIDAR-based terrain awareness, computer vision systems that resolve runway markings through fog using non-visible wavelengths, and synthetic vision approaches that fuse radar returns, GPS data, and terrain databases are all active areas of development.

None are certified for line operations as of 2026. But the trajectory of autoland - from British fog-research experiment in the late 1950s to invisible routine by the 1980s - suggests the pattern by which aviation absorbs the next generation of capability. When it works well enough, it stops being remarkable. That is probably the highest compliment an engineering system can earn.

Key Takeaways

Category IIIb is the operational benchmark for autoland: decision height below 50 feet, RVR as low as 300 feet - conditions where the crew may not see the runway before touchdown
Fail-operational autoland requires three independent computers that vote on every control input; losing one reduces the system to fail-passive, and dropping to LAND 2 below 1,000 feet on a Cat IIIb approach requires a go-around
The first certified blind landing in commercial service was in June 1965, on a British European Airways Trident - operational autoland experience predates fly-by-wire aircraft by nearly two decades
True Cat IIIb approaches are rare for most line crews; most pilots fly only a handful in a career, which creates a persistent gap between procedural currency and real-world proficiency
The accidents in low-visibility operations most often involve crew monitoring failures, not autoland system failures - sustained vigilance for a system that almost never fails remains the hardest part of the procedure