Background Commercial aviation autoland was initially developed in the
United Kingdom, as a result of the frequent occurrence of very low visibility conditions in winter in
Northwest Europe. These occur particularly when
anticyclones are in place over
Central Europe in November/December/January when temperatures are low, and
radiation fog easily forms in relatively stable air. The severity of this type of fog was exacerbated in the late 1940s and 1950s by the prevalence of carbon and other smoke particles in the air from
coal burning heating and power generation. Cities particularly affected included the main UK centers, and their airports such as
London Heathrow,
London Gatwick,
Manchester,
Birmingham and
Glasgow, as well as European cities such as
Amsterdam,
Brussels,
Paris,
Zurich and
Milan. Visibility at these times could become as low as a few feet (hence the
London fogs of movie fame) and, when combined with the soot, created lethal long-persistence smog. These conditions led to the passing of the UK's "
Clean Air Act," which banned the burning of smoke-producing fuel. During the immediate post-war period,
British European Airways (BEA) suffered a number of accidents during approach and landing in poor visibility, which caused it to focus on the problems of how pilots could land safely in such conditions. A major breakthrough came with the recognition that in such low visibility the very limited visual information available (lights and so on) was extraordinarily easy to misinterpret, especially when the requirement to assess it was combined with a requirement to simultaneously fly the aircraft on instruments. This led to the development of what is now widely understood as the "monitored approach" procedure. One pilot is assigned the task of accurate instrument flying while the other assesses the visual cues available at
decision height, taking control to execute the landing once satisfied that the aircraft is in fact in the correct place and on a safe trajectory for a landing. The result was a major improvement in the safety of operations in low visibility, and as the concept clearly incorporates vast elements of what is now known as
crew resource management (although predating this phrase by some three decades) it was expanded to encompass a far broader spectrum of operations than just low visibility. However, associated with this "human factors" approach was a recognition that improved autopilots could play a major part in low-visibility landings. The components of all landings are the same, involving navigation from a point at altitude en route to a point where the wheels are on the desired runway. This navigation is accomplished using information from either external, physical, visual cues, or from synthetic cues such as flight instruments. At all times, there must be sufficient total information to ensure that the aircraft's position and trajectory (vertical and horizontal) are correct. The problem with low visibility operations is that the visual cues may be reduced to effectively zero, and hence there is an increased reliance on "synthetic" information. The dilemma faced by BEA was to find a way to operate without cues, because this situation occurred on its network with far greater frequency than on that of any other airline. It was particularly prevalent at its home base, London Heathrow, which could effectively be closed for days at a time.
Development of autoland The United Kingdom government's aviation research facilities including the
Blind Landing Experimental Unit (BLEU) set up during 1945/46 at
RAF Martlesham Heath and
RAF Woodbridge to research all the relevant factors. BEA's flight technical personnel were heavily involved in BLEU's activities in the development of Autoland for its Trident fleet from the late 1950s. The work included analysis of fog structures, human perception,
instrument design, and lighting cues amongst many others. After further accidents, this work also led to the development of aircraft operating minima in the form we know them today. In particular, it led to the requirement that a minimum visibility must be reported as available before the aircraft may commence an approach – a concept that had not existed previously. The basic concept of a "target level of safety" (10^-7) and of the analysis of "fault trees" to determine probability of failure events stemmed from about this period. The basic concept of autoland flows from the fact that an autopilot could be set up to track an artificial signal such as an
Instrument Landing System (ILS) beam more accurately than a human pilot could – not least because of the inadequacies of the electro-mechanical flight instruments of the time. If the ILS beam could be tracked to a lower height then clearly the aircraft would be nearer to the runway when it reached the limit of ILS usability, and nearer to the runway less visibility would be required to see sufficient cues to confirm the aircraft position and trajectory. With an angular signal system such as ILS, as altitude decreases all tolerances must be decreased – in both the aircraft system and the input signal – to maintain the required degree of safety. This is because certain other factors – physical and physiological laws which govern for example the pilot's ability to make the aircraft respond – remain constant. For example, at 300 feet above the runway on a standard 3 degree approach the aircraft will be 6000 feet from the touchdown point, and at 100 feet it will be 2000 feet out. If a small course correction needs 10 seconds to be effected at 180
kts it will take 3000 ft. It will be possible if initiated at 300 feet of height, but not at 100 feet. Consequently, only a smaller course correction can be tolerated at the lower height, and the system needs to be more accurate. This imposes a requirement for the ground-based, guidance element to conform to specific standards, as well as the airborne elements. Thus, while an aircraft may be equipped with an autoland system, it will be totally unusable without the appropriate ground environment. Similarly, it requires a crew trained in all aspects of the operation to recognize potential failures in both airborne and ground equipment, and to react appropriately, to be able to use the system in the circumstances for which it is intended. Consequently, the low visibility operations categories (Cat I, Cat II and Cat III) apply to all 3 elements in the landing – the aircraft equipment, the ground environment, and the crew. The result of all this is to create a spectrum of low visibility equipment, in which an aircraft's autoland autopilot is just one component. The development of these systems proceeded by recognizing that although the ILS would be the source of the guidance, the ILS itself contains lateral and vertical elements that have rather different characteristics. In particular, the vertical element (glideslope) originates from the projected touchdown point of the approach, i.e., typically 1000 ft from the beginning of the
runway, while the lateral element (localizer) originates from beyond the far end. The transmitted glideslope therefore becomes irrelevant soon after the aircraft has reached the runway threshold, and in fact the aircraft has of course to enter its landing mode and reduce its vertical velocity quite a long time before it passes the
glideslope transmitter. The inaccuracies in the basic ILS could be seen in that it was suitable for use down to 200 ft. only (Cat I), and similarly no autopilot was suitable for or approved for use below this height. The lateral guidance from the ILS localizer would, however, be usable right to the end of the landing roll, and hence is used to feed the
rudder channel of the autopilot after touchdown. As aircraft approach the transmitter, its speed is obviously reducing and rudder effectiveness diminishes, compensating to some extent for the increased sensitivity of the transmitted signal. More significantly, however, it means the safety of the aircraft is still dependent on the ILS during rollout. Furthermore, as it taxis off the runway and down any parallel taxiway, it itself acts a reflector and can interfere with the localizer signal. This means that it can affect the safety of any following aircraft still using the localizer. As a result, such aircraft cannot be allowed to rely on that signal until the first aircraft is well clear of the runway and the "Cat. 3 protected area". The result is that when these low visibility operations are taking place, operations on the ground affect operations in the air much more than in good visibility, when pilots can see what is happening. At very busy airports, this results in restrictions in movement which can in turn severely impact the airport's capacity. In short, very low visibility operations such as autoland can only be conducted when aircraft, crews, ground equipment and air and ground traffic control all comply with more stringent requirements than normal. The first "commercial development" automatic landings (as opposed to pure experimentation) were achieved through realizing that the vertical and lateral paths had different rules. Although the localizer signal would be present throughout the landing, the glide slope had to be disregarded before touchdown in any event. It was recognized that if the aircraft had arrived at decision height (200 ft) on a correct, stable approach path – a prerequisite for a safe landing – it would have momentum along that path. Consequently, the autoland system could discard the glideslope information when it became unreliable (i.e., at 200 ft), and use of pitch information derived from the last several seconds of flight would ensure to the required degree of reliability that the descent rate (and hence adherence to the correct profile) would remain constant. This "
ballistic" phase would end at the height when it became necessary to increase pitch and reduce power to enter the landing flare. The pitch change occurs over the runway in the 1000 horizontal feet between the threshold and the glide slope antenna, and so can be accurately triggered by radio altimeter. Autoland was first developed in BLEU and
Royal Air Force (RAF) aircraft such as the
English Electric Canberra,
Vickers Varsity and
Avro Vulcan, and later for BEA's
Trident fleet, which entered service in the early 1960s. The Trident was a 3-engined
jet built by
de Havilland with a similar configuration to the Boeing 727, and was extremely sophisticated for its time. BEA had specified a "zero-visibility" capability for it to deal with the problems of its fog-prone network. It had an autopilot designed to provide the necessary redundancy to tolerate failures during autoland, and it was this design which had triple redundancy. This autopilot used three simultaneous processing channels each giving a physical output. The
fail-safe element was provided by a "voting" procedure using torque switches, whereby it was accepted that in the event that one channel differed from the other two, the probability of two similar simultaneous failures could be discounted and the two channels in agreement would "out-vote" and disconnect the third channel. However, this triple-voting system is by no means the only way to achieve adequate redundancy and reliability, and in fact soon after BEA and de Havilland had decided to go down that route, a parallel trial was set up using a "dual-dual" concept, chosen by BOAC and Vickers for the
VC10 4-engined long range aircraft. This concept was later used on the
Concorde. Some
BAC 1-11 aircraft used by BEA also had a similar system.
Civil aviation The earliest experimental autopilot-controlled landings in commercial service were not in fact full auto landings but were termed "auto-flare". In this mode, the pilot controlled the
roll and
yaw axes manually while the autopilot controlled the "flare" or pitch. These were often done in passenger service as part of the development program. The Trident's autopilot had separate engagement switches for the pitch and roll components, and although the normal autopilot disengagement was by means of a conventional control yoke thumb-button, it was also possible to disengage the roll channel while leaving the pitch channel engaged. In these operations, the pilot had acquired full visual reference, normally well above decision height, but instead of fully disengaging the autopilot with the thumb-button, called for the second officer to latch off the roll channel only. The second officer then controlled the lateral flight path manually while monitoring the autopilot's continued control of the vertical flight path – ready to completely disengage it at the first sign of any deviation. While this sounds as if it may add a risk element, in practice it is of course no different in principle than a training pilot monitoring a trainee's handling during on-line training or qualification. Having proven the reliability and accuracy of the autopilot's ability to safely flare the aircraft, the next elements were to add in similar control of the thrust. This was done by a radio altimeter signal which drove the
autothrottle servos to a flight idle setting. As the accuracy and reliability of the ground based ILS localiser was increased on a step by step basis, it was permissible to leave the roll channel engaged longer and longer, until in fact the aircraft had ceased to be airborne, and a fully automatic landing had in fact been completed. The first such landing in a BEA Trident was achieved at
RAE Bedford (by then home of BLEU) in March 1964. The first on a commercial flight with passengers aboard was achieved on flight BE 343 on 10 June 1965, with a
Trident 1 G-ARPR, from Paris to Heathrow with Captains Eric Poole and Frank Ormonroyd. had its autoland functionality placed in key roles during its marketing. Subsequently, autoland systems became available on a number of aircraft types but the primary customers were those mainly European airlines whose networks were severely affected by radiation fog. Early autoland systems needed a relatively stable air mass and could not operate in conditions of
turbulence and in particular gusty crosswinds. In
North America, it was generally the case that reduced but not zero visibility was often associated with these conditions, and if the visibility really became almost zero in, for example, blowing
snow or other
precipitation then operations would be impossible for other reasons. As a result, neither airlines nor airports placed a high priority on operations in the lowest visibility. The provision of the necessary ground equipment (ILS) and associated systems for Category 3 operations was almost non existent and the major manufacturers did not regard it as a basic necessity for new aircraft. In general, during the 1970s and 1980s, it was available if a customer wanted it, but at such a high price (due to being a reduced production run item) that few airlines could see a cost justification for it. This led to the absurd situation for British Airways that as the launch customer for the
Boeing 757 to replace the Trident, the brand-new "advanced" aircraft had inferior all-weather operations capability compared to the fleet being broken up for scrap. An indication of this philosophical divide is the comment from a senior Boeing vice president that he could not understand why British Airways were so concerned about the Category 3 certification, as there were only at that time two or three suitable runways in North America on which it could be fully used. It was pointed out that British Airways had 12 such runways on its domestic network alone, four of them at its main base at Heathrow. In the 1980s and 1990s, there was increasing pressure globally from customer airlines for at least some improvements in low visibility operations; both for flight regularity and from safety considerations. At the same time, it became evident that the requirement for a true zero-visibility operation (as originally envisaged in the
ICAO Category definitions) had diminished, as clean-air laws had reduced the adverse effect of smoke adding to radiation fog in the worst affected areas. Improved avionics meant that the technology became cheaper to implement, and manufacturers raised the standard of the "basic" autopilot accuracy and reliability. The result was that, on the whole, the larger new airliners were now able to absorb the costs of at least Category 2 autoland systems into their basic configuration. Simultaneously, pilot organizations globally were advocating the use of
Head Up Display systems primarily from a safety viewpoint. Many operators in non-sophisticated environments without many ILS equipped runways were also looking for improvements. The net effect was pressure within the industry to find alternative ways to achieve low visibility operations, such as a "hybrid" system which used a relatively low reliability autoland system monitored by the pilots via a HUD.
Alaska Airlines was a leader in this approach and undertook a lot of development work with Flight Dynamics and Boeing in this respect. A major problem with this approach was that European authorities were very reluctant to certificate such schemes as they undermined the well-proven concepts of "pure" autoland systems. This impasse was broken when
British Airways became involved as a potential customer for Bombardier's
Regional Jet, which could not accommodate a full Cat 3 autoland system, but would be required to operate in those conditions. By working with Alaska Airlines and Boeing, British Airways technical pilots were able to demonstrate that a hybrid concept was feasible, and although British Airways never eventually bought the regional jet, this was the breakthrough needed for international approval for such systems which meant that they could reach a global market. The wheel turned full circle in December 2006 when
London Heathrow was affected for a long period by dense fog. This airport was operating at maximum capacity in good conditions, and the imposition of low visibility procedures required to protect the localizer signal for autoland systems meant a major reduction in capacity from approximately 60 to 30 landings per hour. Since most airlines operating into Heathrow already had autoland-equipped aircraft, and thus expected to operate as normal, massive delays occurred. The worst affected airline was British Airways, as it was the largest operator at the airport.
Emergency autoland Garmin Aviation started studying an emergency autoland feature in 2001 and launched the program in 2010 with more than 100 employees, investing around $20 million. Flight tests began in 2014 with 329 test landings completed in a
Cessna 400 Corvalis and another 300 landings in other aircraft. The feature is activated by a guarded red button on
Garmin G3000 avionics. It evaluates winds, weather and fuel reserves to select a suitable
diversion airport and takes over the aircraft controls to land. In addition, it advises
ATC of the feature's intentions and displays instructions to occupants. In June 2021, the Garmin Autoland system won the 2020
Collier Trophy, for "the greatest achievement in aeronautics or astronautics in America" during the preceding year. On December 20, 2025, the first recorded true emergency activation of a fully autonomous Autoland system occurred after avionic-detection of unsafe
low cabin pressure initiated the system in a
Beechcraft Super King Air B200 twin-
turboprop aircraft (call sign N479BR) culminating in a full-stop landing and post-landing engine shutdown. The Autoland system, which automatically chose a suitable airport, flight plan, and descent from high altitude pattern, landed safely at
Rocky Mountain Metropolitan Airport Broomfield, Colorado. During the event, the autoland subsystem tuned the radio to proper tower frequency, transmitted
computer-enunciated voice radio messages including call sign, pilot incapacitation, aircraft position, and estimated time of arrival to the chosen airport. Updates were transmitted every few minutes to which ground emergency units and air traffic controllers prepared the airport and cleared approach airspace for the emergency aircraft. The incident marked the first recorded instance of a fully navigated and planned, pilot-incapacitation autoland in U.S.
general aviation history. ==Systems==