a certified autoland system cannot have a failure mode (i.e. a failure of a single autopilot channel) that would jeopardise a safe landing.
Which is why "Fail Passive" 737s are restricted to catIIIA operations. Disagreement between th two autopilots causes disengagement of BOTH- but in theory there will be suficient visibility to take over and hand fly a missed approach.