An autoland system that is fail operational can withstand a
single failure and can continue to autoland
automatically, with a failure it is now called fail passive because it cannot
withstand another failure and continue with the autoland.
ie. A/C with 3 A/P's, system is fail operational, one
A/P fails, system is now fail passive.