From an avionics safety perspective, a CAT IIIc landing is the worst-case scenario for safety analysis because a failure of the automatic systems from flare through the roll-out could easily result in a "hard over" (where a control surface deflects fully in one direction.) This would happen so fast that the flight crew may not effectively respond. For this reason autoland systems are designed to incorporate a high degree of redundancy so that a single failure of any part of the system can be tolerated (fail active) and a second failure can be detected – at which point the autoland system will turn itself off (uncouple, fail passive).