Extract from CS-AWO:
(4) Fail-operational Automatic Landing System: An automatic landing system is fail-operational if, in the event of a failure, the approach, flare and landing can be completed by the remaining part of the automatic system. In the event of a failure, the automatic landing system will operate as a fail-passive system.
The following are typical arrangements:
(i) Two monitored automatic pilots, one remaining operative after a failure.
(ii) Three automatic pilots, two remaining operative (to permit comparison and provide necessary failure detection and protection) after a failure.
Apparently you can receive fail-operational status with two
monitored autopilots. But what a monitored autopilot is, I'am clueless
