Heathrow, a December morning. The fog is so dense that from the cockpit of a taxiing 777 the crew cannot see their own wingtip. Officially, the runway visual range is 125 metres — about the length of the aircraft plus a bus. And yet, every couple of minutes, 300 tonnes of aluminium settles out of the murk and greases onto the centreline, exactly where it should.

No human being can land a jet in that. Human eyes need visual references, and there are none until seconds before touchdown. What makes it possible is one of the most quietly remarkable systems in commercial aviation: autoland.

Here is how an airliner lands itself — and why, most of the time, the pilots still do it by hand.

The ILS ladder: from CAT I to “no decision height”

Every precision approach hangs on the Instrument Landing System: a localizer beam marking the runway centreline and a glideslope beam marking the 3-degree descent path. What separates an ordinary approach from a blind one is how far down the beams you are allowed to ride them — and that is what the ILS categories define.

A standard CAT I approach requires a decision height of at least 200 ft and visibility around 550 m: reach 200 feet, see the runway or go around. CAT II takes you down to a 100 ft decision height with a runway visual range of roughly 300 m. CAT III is where humans hand over: decision heights below 100 ft or none at all, and visibility that shrinks to around 175–200 m for CAT IIIA and as little as 75 m for CAT IIIB. The exact numbers differ slightly between the FAA and EASA rulebooks — Europe’s latest all-weather-operations rules have even folded the old IIIA/IIIB split into a single CAT III framework — but the logic is universal: the less you can see, the more capable and redundant your aircraft, your crew and the airport’s equipment must be.

A theoretical CAT IIIC — zero decision height, zero visibility — exists on paper and is used nowhere. Even if you could land in absolute fog, you could never taxi to the gate.

Fail-passive, fail-operational, and the art of not trusting one computer

Autoland’s central design question is brutal: what happens if the system fails at 40 feet? The answer comes in two flavours. A fail-passive system — typically two autopilots cross-checking each other — guarantees that a single failure will not throw the aircraft out of trim, but the landing must be abandoned; that is why fail-passive aircraft keep a decision height of around 50 ft. A fail-operational system — two or three autopilots plus duplicated everything — can absorb a failure and simply continue landing automatically.

Fail-operational aircraft swap the decision height for something subtler: an alert height, around 100 ft on an A320 and 200 ft on Boeings. Above it, any significant failure means go-around. Below it, the aircraft is committed — the remaining systems are trusted to finish the job, and statistics say they will: certification demands the probability of a catastrophic failure be vanishingly small.

The last fifty feet

Down the final approach, the autopilots track the beams. But the beams cannot land the aircraft — near the ground they get noisy, and no glideslope tells you when to break the descent. That job belongs to the radio altimeter, which bounces radio waves off the ground and reads the height above the runway to within a few feet.

At roughly 50 ft, the automation begins the flare — the gentle nose-up that trades descent rate for a soft touchdown. Around 30 ft, the autothrottle pulls the power to idle. On touchdown, the rollout mode takes over, steering with rudder and nosewheel to hold the invisible centreline while the pilots decelerate the aircraft. On a fail-operational jet, the machine has flown every inch from 1,000 ft to walking pace.

And through all of it, the pilots sit with hands resting on the controls and thrust levers. Not for comfort — procedure. One pilot monitors the instruments and calls deviations; the other is primed to take over or go around the instant anything disagrees. Autoland does not remove the crew from the loop; it moves them one level up, from flying the aircraft to interrogating it.

So why not autoland everything?

Given all this capability, you might expect autoland to be the default. It is the opposite: only a small fraction of landings are automatic. Veteran US airline pilot and author Patrick Smith puts a number on it.

The reasons stack up quickly. Most days, the weather simply does not require it — and a manual landing keeps a pilot’s hand-flying sharp. When autolands do happen in good weather, it is often for the opposite reason: crews and aircraft must perform them periodically to stay autoland-current, because certification lapses without practice.

Then there is the airport. In low-visibility procedures, the ILS “critical areas” near the antennas must be kept clear of taxiing aircraft and vehicles, because a fuselage in the wrong place literally bends the beam. Arrivals get spaced further apart, departures wait longer, and a runway that handles 45 movements an hour in sunshine may manage far fewer in fog. Autoland saves the day precisely by accepting a slower one.

And that is the aha of autoland: it was never meant to replace pilots. It is a specialist tool for a specific, rare problem — the fog-bound runway — wrapped in redundancy and procedure. The machine flies; the humans command.

Next time you break out of solid cloud at 100 feet and feel the wheels kiss exactly on centreline, you will know what just happened: two or three autopilots agreed with each other all the way down, a radio altimeter counted the last fifty feet, and two unhurried professionals watched every parameter, ready to take it all back in half a second. Landing blind, it turns out, is the most supervised landing there is.

Sources: FAA, EASA, SKYbrary, AskThePilot.com (Patrick Smith), Airbus/Boeing flight crew documentation