3-engined jet built by de Havilland with a similar configuration to the Boeing 727, and was extremely sophisticated for its time. BEA had specified a "zero-visibility" capability for it to deal with the problems of its fog-prone network. It had an autopilot designed to provide the necessary redundancy to tolerate failures during autoland, and it was this design which had triple redundancy. This autopilot used three simultaneous processing channels each giving a physical output. The fail-safe element was provided by a "voting" procedure using torque switches, whereby it was accepted that in the event that one channel differed from the other two, the probability of two similar simultaneous failures could be discounted and the two channels in agreement would "out-vote" and disconnect the third channel. However, this triple-voting system is by no means the only way to achieve adequate redundancy and reliability, and in fact soon after BEA and de Havilland had decided to go down that route, a parallel trial was set up using a "dual-dual" concept, chosen by BOAC and Vickers for the VC10 4-engined long range aircraft. This concept was later used on the Concorde. Some BAC 1-11 aircraft used by BEA also had a similar system. Civil aviation The earliest experimental autopilot-controlled landings in commercial service were not in fact full auto landings but were termed "auto-flare". In this mode, the pilot controlled the roll and yaw axes manually while the autopilot controlled the "flare" or pitch. These were often done in passenger service as part of the development program. The Trident's autopilot had separate engagement switches for the pitch and roll components, and although the normal autopilot disengagement was by means of a conventional control yoke thumb-button, it was also possible to disengage the roll channel while leaving the pitch channel engaged. In these operations the pilot had acquired full visual reference, normally well above decision height, but instead of fully disengaging the autopilot with the thumb-button, called for the second officer to latch off the roll channel only. The second officer then controlled the lateral flight path manually while monitoring the autopilot's continued control of the vertical flight path – ready to completely disengage it at the first sign of any deviation. While this sounds as if it may add a risk element in practice it is of course no different in principle to a training pilot monitoring a trainee's handling during on-line training