我记得我以前见过这两个概念，怎么找不到了，现在补上。

《AC 120-28D CRITERIA FOR APPROVAL OF CATEGORY III WEATHER MINIMA FOR TAKEOFF, LANDING, AND ROLLOUT》

A Fail Operational System is a system which after failure of any single component, is capable of completing an approach, flare and touchdown, or approach, flare, touchdown and rollout by using the remaining operating elements of the Fail Operational system. The failure effects of single components of the system, airplane or equipment external to the airplane which could have an effect on touchdown or rollout performance must be considered when evaluating Fail Operational systems. Fail Operational systems may be used to touchdown for Category IIIa (e.g., without a rollout system) or Category IIIb through rollout to a full stop. Use of a fail-operational system to touchdown in conjunction with a rollout system that is not fail-operational is acceptable as long as a suitable minimum RVR is specified in the operations specifications, for rollout.

Fail Operational代表系统中单个组件故障后，剩余的部件任然可以完成近进。

A Fail Passive System is a system which in the event of a failure, causes no significant deviation of aircraft flight path or attitude. The capability to continue the operation may be lost and an alternate course of action (e.g., a missed approach) may be required. A fail-passive system is the minimum capability system acceptable for Category III operation with a Decision Height not less than 50 ft. HAT.

Fail Passive代表系统失效不会造成严重偏离，但是继续近进的能力无法维持了。Fail Passive是50ft三类盲降的最低要求。